help
CommandShow available THRUNT threat hunting commands and artifact layout
Remove a future phase from huntmap and renumber subsequent phases
name: thrunt:remove-phase description: Remove a future phase from huntmap and renumber subsequent phases argument-hint: <phase-number> allowed-tools: - Read - Write - Bash - Glob
<objective> Remove an unstarted future phase from the huntmap and renumber all subsequent phases to maintain a clean, linear sequence.
Purpose: Clean removal of work you've decided not to do, without polluting context with cancelled/deferred markers. Output: Phase deleted, all subsequent phases renumbered, git commit as historical record. </objective>
<execution_context> @~/.claude/thrunt-god/workflows/remove-phase.md </execution_context>
<context> Phase: $ARGUMENTS
Huntmap and state are resolved in-workflow via `init phase-op` and targeted reads. </context>
<process> Execute the remove-phase workflow from @~/.claude/thrunt-god/workflows/remove-phase.md end-to-end. Preserve all validation gates (future phase check, work check), renumbering logic, and commit. </process>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…