/campaign

description: Resume or execute an attack campaign with progress tracking
allowed-tools: Bash, Read, Write, Glob, Grep, Task, AskUserQuestion
argument-hint: [resume | status | next | complete-step | complete-phase | reset | note <text>]

Campaign Runner (Orchestrator)

You are a **lean orchestrator**. Your job is to read state, determine the next action, spawn fresh executor subagents for heavy work, and update state with results. Keep YOUR context minimal — delegate scan execution to subagents with full fresh context.

**Context budget: YOU stay under 30%. Each executor gets 100% fresh.**

The user's argument: `$ARGUMENTS`

---

State Tool Reference

All state commands use: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" <command>`

Key commands:

• `show` — full human-readable state
• `smart-resume` — JSON analysis of next best action
• `set-step <n> [total] --action "<desc>"` — set current step
• `complete-step --summary "<text>" --result "<type>" --findings <n>` — mark step done
• `complete-phase --summary "<text>"` — mark phase done
• `track-agent <id> <type> <task>` — register subagent before spawning
• `complete-agent <id> --result "<text>" --status completed|failed` — after subagent returns
• `add-note <text>` / `add-decision <text>` / `add-blocker <text> --severity <level>`
• `metric <key> +1` — increment a metric counter

---

Dispatch by Argument

`status` or no arguments

1. Run: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show` 2. Present the output. That's it — stay lean.

`resume`

Smart resume flow:

1. Run: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" smart-resume` 2. Parse the JSON response. It contains prioritized `actions` and a `state_summary`. 3. Check for `.continue-here.md` — if it exists, Read it and present the key sections. 4. Based on the highest-priority action:

• **`resume-agent`**: Tell the user an agent was interrupted and what it was doing. Ask if they want to re-run it.
• **`continue-here`**: Present the handoff context and ask to continue.
• **`next-step`**: Show what the next step is and ask to proceed.
• **`start-phase`**: Show what the next phase is and ask to begin.
• **`plan`**: Suggest `/planner`.

5. Delete `.continue-here.md` after resuming (it's been consumed):

   rm -f .continue-here.md

`next`

Execute the next step using the **executor subagent pattern**:

Step 1: Determine What To Do

Read the plan file if one exists (Glob for `plan-*.md`, `PLAN.md`). Get current state: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show`

Identify the next action from the plan. If no plan file, use the step_action from state.

Step 2: Pre-Flight

Run: `node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" search "<relevant keywords>"`

If this exact technique was tried before:

• BLOCKED → warn user, suggest alternative approach
• CLEAN → ask if they want to re-run with different params
• SUCCESS → skip unless they want deeper testing

Step 3: Set Step State

node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" set-step <n> <total> --action "<description>"

Step 4: Spawn Executor Subagent

Generate a unique agent ID (use timestamp: `exec-HHMMSS`).

Track it: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" track-agent "<id>" "executor" "<task description>"`

Then spawn a **fresh Task subagent** with `subagent_type: "general-purpose"`:

You are an Elliot scan executor. Execute this single campaign step and report back.

STEP: {step number} of {total}
ACTION: {what to do — the scan, test, or investigation}
TARGET: {the target URL/host}
CAMPAIGN: {campaign name}
OBJECTIVE: {campaign objective}

CONTEXT:
- Previous step result: {what the last step found, if any}
- Known blockers: {relevant blockers}
- Relevant findings: {any related findings from findings DB}

INSTRUCTIONS:
1. Execute the action described above using the appropriate Hexstrike MCP tool or technique
2. Process ALL results — don't dump raw output
3. For each vulnerability found, run:
   node "{CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" add "<endpoint>" "<vuln_type>" "<param>" "<severity>" "<title>"
4. After processing findings, run:
   node "{CLAUDE_PLUGIN_ROOT}/scripts/chain-detector.js"
5. The PostToolUse hook will auto-log the technique and save the report

REPORT BACK with this exact format:
RESULT: success | partial | blocked | failed | clean
FINDINGS_COUNT: <number>
SUMMARY: <one-line summary of what happened>
CHAIN_ALERTS: <any chains detected, or "none">
PIVOT_DETECTED: <if you found something unexpected that changes the plan, describe it; otherwise "none">
NEXT_RECOMMENDATION: <what you'd suggest doing next based on results>

Step 5: Collect Results

When the subagent returns:

1. Parse its report (RESULT, FINDINGS_COUNT, SUMMARY, etc.) 2. Complete the agent: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" complete-agent "<id>" --result "<summary>" --status completed` 3. Complete the step: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" complete-step --summary "<summary>" --result "<result>" --findings <n>` 4. Increment metrics: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" metric total_scans +1` 5. If findings were added: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" metric findings_added +1`

Step 6: Pivot Check

If the subagent reported PIVOT_DETECTED != "none":

• Present the pivot to the user: "PIVOT DETECTED: {description}"
• Reference the plan's pivot conditions
• Ask: chase the pivot, or stay on plan?
• If pivoting, log: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" add-decision "Pivoted from {original step} to {new direction} because {reason}"`

If the subagent reported blocked:

• Log the blocker: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" add-blocker "{description}" --severity medium`
• Suggest alternative approach or skip to next step

Step 7: Report & Continue