/plan
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
$ npx -y skills add backbay-labs/thrunt-god --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/plan
Context preview
What this command does when you run it.
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Command definition
plan.mdname: hunt:plan description: Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs argument-hint: "<phase>" allowed-tools: - Read - Bash - Write - Task
<objective> Plan a hunt phase from the current HUNTMAP.
`HUNTMAP.md` remains the source of truth for phase layout and sequencing.
**Creates or updates:**
- `.planning/phases/[phase-slug]/`
- `CONTEXT.md`
- `PLAN.md` files
- `.planning/STATE.md`
- `.planning/HUNTMAP.md` when phase metadata changes
**After this command:** Run `/hunt:run <phase>`. </objective>
<execution_context> @~/.claude/thrunt-god/workflows/hunt-plan.md @~/.claude/thrunt-god/templates/context.md @~/.claude/thrunt-god/templates/phase-prompt.md </execution_context>
<process> Execute the hunt planning workflow from @~/.claude/thrunt-god/workflows/hunt-plan.md. Plans must name the telemetry source, intended evidence, and required receipts. </process>
Threat hunting command system for agentic IDEs
Repo: backbay-labs/thrunt-god
Other commands on thrunt-god.
- /help
Show available THRUNT threat hunting commands and artifact layout
Open command - /map-environment
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Open command - /new-case
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Open command - /new-program
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Open command - /publish
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Open command - /run
Execute a hunt phase with parallel telemetry work, query logging, receipt generation, and optional wave targeting
Open command