help
CommandShow available THRUNT threat hunting commands and artifact layout
Generate developer behavioral profile and create Claude-discoverable artifacts
name: thrunt:profile-user description: Generate developer behavioral profile and create Claude-discoverable artifacts argument-hint: "[--questionnaire] [--refresh]" allowed-tools: - Read - Write - Bash - Glob - Grep - AskUserQuestion - Task
<objective> Generate a developer behavioral profile from session analysis (or questionnaire) and produce artifacts (USER-PROFILE.md, /thrunt:dev-preferences, CLAUDE.md section) that personalize Claude's responses.
Routes to the profile-user workflow which orchestrates the full flow: consent gate, session analysis or questionnaire fallback, profile generation, result display, and artifact selection. </objective>
<execution_context> @~/.claude/thrunt-god/workflows/profile-user.md @~/.claude/thrunt-god/references/ui-brand.md </execution_context>
<context> Flags from $ARGUMENTS:
</context>
<process> Execute the profile-user workflow end-to-end.
The workflow handles all logic including: 1. Initialization and existing profile detection 2. Consent gate before session analysis 3. Session scanning and data sufficiency checks 4. Session analysis (profiler agent) or questionnaire fallback 5. Cross-project split resolution 6. Profile writing to USER-PROFILE.md 7. Result display with report card and highlights 8. Artifact selection (dev-preferences, CLAUDE.md sections) 9. Sequential artifact generation 10. Summary with refresh diff (if applicable) </process>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…