help
CommandShow available THRUNT threat hunting commands and artifact layout
Capture idea or task as todo from current conversation context
name: thrunt:add-todo description: Capture idea or task as todo from current conversation context argument-hint: "[optional description]" allowed-tools: - Read - Write - Bash - AskUserQuestion
<objective> Capture an idea, task, or issue that surfaces during a THRUNT session as a structured todo for later work.
Routes to the add-todo workflow which handles:
</objective>
<execution_context> @~/.claude/thrunt-god/workflows/add-todo.md </execution_context>
<context> Arguments: $ARGUMENTS (optional todo description)
State is resolved in-workflow via `init todos` and targeted reads. </context>
<process> **Follow the add-todo workflow** from `@~/.claude/thrunt-god/workflows/add-todo.md`.
The workflow handles all logic including: 1. Directory ensuring 2. Existing area checking 3. Content extraction (arguments or conversation) 4. Area inference 5. Duplicate checking 6. File creation with slug generation 7. STATE.md updates 8. Git commits </process>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…