help
CommandShow available THRUNT threat hunting commands and artifact layout
Generate tests for a completed phase based on Evidence Review criteria and implementation
name: thrunt:add-tests description: Generate tests for a completed phase based on Evidence Review criteria and implementation argument-hint: "<phase> [additional instructions]" allowed-tools: - Read - Write - Edit - Bash - Glob - Grep - Task - AskUserQuestion argument-instructions: | Parse the argument as a phase number (integer, decimal, or letter-suffix), plus optional free-text instructions. Example: /thrunt:add-tests 12 Example: /thrunt:add-tests 12 focus on edge cases in the pricing module
<objective> Generate unit and E2E tests for a completed phase, using its SUMMARY.md, CONTEXT.md, and FINDINGS.md as specifications.
Analyzes implementation files, classifies them into TDD (unit), E2E (browser), or Skip categories, presents a test plan for user approval, then generates tests following RED-GREEN conventions.
Output: Test files committed with message `test(phase-{N}): add unit and E2E tests from add-tests command` </objective>
<execution_context> @~/.claude/thrunt-god/workflows/add-tests.md </execution_context>
<context> Phase: $ARGUMENTS
@.planning/STATE.md @.planning/HUNTMAP.md </context>
<process> Execute the add-tests workflow from @~/.claude/thrunt-god/workflows/add-tests.md end-to-end. Preserve all workflow gates (classification approval, test plan approval, RED-GREEN verification, gap reporting). </process>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…