help
CommandShow available THRUNT threat hunting commands and artifact layout
Run all remaining phases autonomously — discuss→plan→execute per phase
name: thrunt:autonomous description: Run all remaining phases autonomously — discuss→plan→execute per phase argument-hint: "[--from N]" allowed-tools: - Read - Write - Bash - Glob - Grep - AskUserQuestion - Task
<objective> Execute all remaining milestone phases autonomously. For each phase: discuss → plan → execute. Pauses only for user decisions (grey area acceptance, blockers, validation requests).
Uses HUNTMAP.md phase discovery and Skill() flat invocations for each phase command. After all phases complete: milestone audit → complete → cleanup.
**Creates/Updates:**
**After:** Milestone is complete and cleaned up. </objective>
<execution_context> @~/.claude/thrunt-god/workflows/autonomous.md @~/.claude/thrunt-god/references/ui-brand.md </execution_context>
<context> Optional flag: `--from N` — start from phase N instead of the first incomplete phase.
Project context, phase list, and state are resolved inside the workflow using init commands (`thrunt-tools.cjs init milestone-op`, `thrunt-tools.cjs huntmap analyze`). No upfront context loading needed. </context>
<process> Execute the autonomous workflow from @~/.claude/thrunt-god/workflows/autonomous.md end-to-end. Preserve all workflow gates (phase discovery, per-phase execution, blocker handling, progress display). </process>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…