/ingest

description: Ingest recon files to build engagement context and extract findings
allowed-tools: Bash, Read, Write, Glob, Grep, Task
argument-hint: <path-to-file-or-directory>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Ingest Reconnaissance Files

You are ingesting reconnaissance files to extract vulnerability findings and build engagement context. The target path is: `$ARGUMENTS`

---

Step 1: Validate Path

If `$ARGUMENTS` is empty or blank, print this and stop:

Usage: /ingest <path-to-file-or-directory>

Examples:
  /ingest /path/to/recon-notes
  /ingest ./ATTACK-VECTORS.md
  /ingest ./reports/

Use Bash to validate the path exists and resolve it to an absolute path:

realpath "$ARGUMENTS"

Determine if the path is a **file** or **directory** using `test -f` / `test -d`.

---

Step 2: Discover Files

**If single file**: Skip to Step 4 (process directly).

**If directory**: Use Glob to find all ingestible files:

• `**/*.md` — markdown files
• `**/*.json` — JSON files (but NOT `findings-db.jsonl`)
• `**/*.txt` — text files

Exclude these from results:

• `findings-db.jsonl`
• `engagement-context.md`
• Any file starting with `.`

Count the files. If zero, print "No ingestible files found" and stop.

---

Step 3: Decide Processing Mode

• **≤3 files**: Process directly — Read each file yourself and extract findings + context inline (go to Step 4)
• **4+ files**: Batch into groups of **5 files** and spawn parallel Task subagents (go to Step 5)

---

Step 4: Direct Processing (Single File or ≤3 Files)

Read each file with the Read tool.

For each file, extract:

A. Vulnerability Findings

Identify every distinct vulnerability or security issue mentioned. For each one, extract:

• **endpoint**: The URL path or endpoint (e.g., `/api/auth/reset-password`, `POST /api/payments/generate`)
• **vuln_type**: Category — `idor`, `sqli`, `xss`, `auth-bypass`, `rce`, `info-leak`, `config`, `rate-limit`, `user-enum`, `ssrf`, `lfi`, `ssti`, `xxe`, `type-confusion`, or other
• **param**: The vulnerable parameter name, or `none` if not parameter-specific
• **severity**: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, or `INFO`
• **title**: Brief descriptive title (max 80 chars)

B. Engagement Context

Extract key intelligence: 1. **Discovered Endpoints** — all API endpoints, PHP scripts, routes with brief description and auth requirement 2. **Credentials** — usernames, emails, passwords, API keys, tokens, PIX keys 3. **Technology Stack** — CMS versions, frameworks, languages, servers, WAF/CDN, databases 4. **Attack Chains** — multi-step exploitation paths 5. **Blockers** — what prevents exploitation (expired tokens, captcha, rate limits, WAF blocks) 6. **Unresolved Questions** — research gaps, unknowns

After extraction, skip to Step 6.

---

Step 5: Parallel Processing (4+ Files)

Group files into batches of 5. For each batch, spawn a Task with `subagent_type: "general-purpose"`.

**IMPORTANT**: Launch ALL batch Tasks in a SINGLE message (parallel tool calls) for maximum concurrency.

Each Task prompt should be:

Analyze these reconnaissance files and extract vulnerability findings and engagement context.

FILES TO READ:
{list each absolute file path, one per line}

---

INSTRUCTIONS:

Read each file using the Read tool. Extract two types of information:

## A. VULNERABILITY FINDINGS

For each distinct vulnerability or security issue, extract a pipe-delimited line:

endpoint|vuln_type|param|severity|title

Rules:
- endpoint: URL path as written (preserve leading slash)
- vuln_type: idor, sqli, xss, auth-bypass, rce, info-leak, config, rate-limit, user-enum, ssrf, lfi, type-confusion, etc.
- param: vulnerable parameter name, or "none"
- severity: CRITICAL, HIGH, MEDIUM, LOW, or INFO (uppercase)
- title: brief description, max 80 chars
- One finding per line, no extra whitespace around pipes

Examples:
/api/payments/generate|idor|recipient|CRITICAL|Unauthenticated payment IDOR via recipient parameter
/api/auth/reset-password|rate-limit|code|HIGH|Reset password brute-force no rate limit

## B. ENGAGEMENT CONTEXT

### Discovered Endpoints
- {path}: {description} ({auth requirement})

### Credentials
- {type}: {value}

### Technology Stack
- {component}: {version/details}

### Attack Chains
- {description}

### Blockers
- {description}

### Unresolved Questions
- {question}

---

RETURN FORMAT — use these exact headers:

## FINDINGS
{pipe-delimited lines, one per finding, or "(none)" if no findings}

## CONTEXT
{structured sections as above}

Wait for all Tasks to complete.

---

Step 6: Import Findings to Database

For each extracted finding, run:

node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" add "<endpoint>" "<vuln_type>" "<param>" "<severity>" "<title>"

The tracker returns either:

• `ADDED: f-XXX — [SEVERITY] title` — new finding recorded
• `DUPLICATE: f-XXX (already tracked)` — skipped

Count the ADDED vs DUPLICATE results for the summary.

**IMPORTANT**: Run these sequentially (each `add` call depends on the DB state from prior calls). You may batch multiple calls in a single Bash invocation using `&&` chains for efficiency:

node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" add "/endpoint1" "idor" "param1" "CRITICAL" "Title 1" && \
node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" add "/endpoint2" "xss" "param2" "HIGH" "Title 2"

---

Step 7: Write Engagement Context Document

Use the Write tool to create `engagement-context.md` in the project directory.

Structure the document as follows:

# Engagement Context

**Generated:** {today's date}
**Source:** {file count} files ingested from {source path}
**Findings:** {new_count} new findings added, {dup_count} duplicates skipped

---

## Target Profile

{Infer the target domain and description from the content, or write "Unknown — run /scope <target>