help
CommandShow available THRUNT threat hunting commands and artifact layout
Review and promote backlog items to active milestone
name: thrunt:review-backlog description: Review and promote backlog items to active milestone allowed-tools: - Read - Write - Bash
<objective> Review all 999.x backlog items and optionally promote them into the active milestone sequence or remove stale entries. </objective>
<process>
1. **List backlog items:**
ls -d .planning/phases/999* 2>/dev/null || echo "No backlog items found"
2. **Read HUNTMAP.md** and extract all 999.x phase entries:
cat .planning/HUNTMAP.md
Show each backlog item with its description, any accumulated context (CONTEXT.md, RESEARCH.md), and creation date.
3. **Present the list to the user** via AskUserQuestion:
4. **For items to PROMOTE:**
NEW_NUM=$(node "$HOME/.claude/thrunt-god/bin/thrunt-tools.cjs" phase add "${DESCRIPTION}" --raw)5. **For items to REMOVE:**
6. **Commit changes:**
node "$HOME/.claude/thrunt-god/bin/thrunt-tools.cjs" commit "docs: review backlog — promoted N, removed M" --files .planning/HUNTMAP.md
7. **Report summary:**
## 📋 Backlog Review Complete
Promoted: {list of promoted items with new phase numbers}
Kept: {list of items remaining in backlog}
Removed: {list of deleted items}</process>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…