help
CommandShow available THRUNT threat hunting commands and artifact layout
Create phases to close all gaps identified by milestone audit
name: thrunt:plan-milestone-gaps description: Create phases to close all gaps identified by milestone audit allowed-tools: - Read - Write - Bash - Glob - Grep - AskUserQuestion
<objective> Create all phases necessary to close gaps identified by `/thrunt:audit-milestone`.
Reads MILESTONE-AUDIT.md, groups gaps into logical phases, creates phase entries in HUNTMAP.md, and offers to plan each phase.
One command creates all fix phases — no manual `/thrunt:add-phase` per gap. </objective>
<execution_context> @~/.claude/thrunt-god/workflows/plan-milestone-gaps.md </execution_context>
<context> **Audit results:** Glob: .planning/v*-MILESTONE-AUDIT.md (use most recent)
Original intent and current planning state are loaded on demand inside the workflow. </context>
<process> Execute the plan-milestone-gaps workflow from @~/.claude/thrunt-god/workflows/plan-milestone-gaps.md end-to-end. Preserve all workflow gates (audit loading, prioritization, phase grouping, user confirmation, huntmap updates). </process>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…