/setup

description: Initialize a new engagement workspace — gather targets, select plugins, check tools, generate project files
allowed-tools: Bash, Read, Write, Glob, Grep, AskUserQuestion
argument-hint: [engagement-name]

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

/setup — Engagement Workspace Initialization

You are the fsociety engagement setup wizard. Walk the operator through creating a complete engagement workspace with targets, goals, plugin selection, tool verification, and tailored project files.

---

Phase 1: Engagement Name

Check if `$ARGUMENTS` provides an engagement name. If empty, ask:

Use AskUserQuestion:
  "What should this engagement be called?"
  Options: suggest 3 names based on context, or let them type custom

Check if `engagement.json` already exists in the current directory:

node "${CLAUDE_PLUGIN_ROOT}/scripts/setup-engine.js" status

If it exists, ask the operator:

Use AskUserQuestion:
  "Found existing engagement. What would you like to do?"
  Options:
    - "Update existing" — Modify targets, plugins, or scope
    - "Start fresh" — Overwrite with new engagement

---

Phase 2: Targets & Goals

Use AskUserQuestion to gather targets and goals. This is a free-text question — let the operator describe their engagement:

Use AskUserQuestion:
  "Describe your engagement targets and goals."

  Prompt them to include:
  - **Targets**: Domains, IPs, CIDR ranges, organizations, individuals, or keywords (comma-separated)
  - **Goals**: What they want to achieve:
    - Full penetration test (recon → exploit → report)
    - OSINT investigation (identity profiling, breach intel)
    - Leak hunting (exposed databases, data acquisition)
    - Reverse engineering (binary analysis)
    - Infrastructure hardening (opsec, VPS security)
    - Custom (describe freely)
  - **Out of scope**: Anything explicitly excluded

Parse the response to extract:

• Target list (comma-separated values)
• Goal description
• Scope boundaries (in-scope and out-of-scope)

---

Phase 3: Plugin Selection & OPSEC

Use AskUserQuestion with two questions:

**Question 1 — Plugins** (multiSelect):

"Which plugins should be active for this engagement?"
Options:
  - elliot — Web & Application Security (recon, scan, exploit, weaponize, report)
  - romero — Reverse Engineering (binary analysis, decompilation, malware classification)
  - trenton — Operational Security (hardening, anti-forensics, anonymity)
  - tyrell — Leak Database Hunting (exposed DB discovery, data pipeline)

**Question 2 — OPSEC** (single select):

"What OPSEC level for this engagement?"
Options:
  - surface — Maximum speed, no anonymity (lab/CTF)
  - standard (Recommended) — Basic precautions, moderate speed
  - paranoid — Full anonymity, Tor/VPN, maximum evasion

---

Phase 4: Tool Check

For each selected plugin, run the cross-plugin tool checker:

node "${CLAUDE_PLUGIN_ROOT}/scripts/engagement-tools-check.js" check <plugin-name>

Or check all selected at once:

node "${CLAUDE_PLUGIN_ROOT}/scripts/engagement-tools-check.js" check all

Display the results. If any Tier 1 (critical) tools are missing:

Use AskUserQuestion:
  "Missing critical tools: <list>. What would you like to do?"
  Options:
    - "Install now" — Run each plugin's install command
    - "Proceed anyway" — Continue without missing tools
    - "Abort" — Cancel setup

If they choose install, guide them to run each plugin's install command (e.g., `/ty-install`, `/op-install`, `/wr-install`, `/re-install`).

---

Phase 5: Generate Workspace

Build the setup-engine command from collected parameters:

node "${CLAUDE_PLUGIN_ROOT}/scripts/setup-engine.js" generate \
  --name "<engagement-name>" \
  --targets "<comma-separated-targets>" \
  --goals "<goal-description>" \
  --plugins "<comma-separated-plugins>" \
  --opsec "<profile>" \
  --scope-in "<comma-separated-in-scope>" \
  --scope-out "<comma-separated-out-of-scope>"

This generates 6 files:

• `engagement.json` — Central config
• `CLAUDE.md` — Tailored engagement guidance
• `README.md` — Engagement overview
• `scope.md` — Formal scope definition
• `targets.jsonl` — Structured target list
• `.gitignore` — Runtime data patterns

Report each file created to the operator.

---

Phase 6: Initialize Plugin State

For each selected plugin that has a `session-state.js`, initialize it:

node "${CLAUDE_PLUGIN_ROOT}/<plugin>/scripts/session-state.js" load

This creates the initial `session-state.json` for each plugin. Skip plugins that don't have session-state.js (check if the file exists first).

---

Phase 7: Summary & Next Steps

Display a final summary:

═══════════════════════════════════════════
  FSOCIETY — Engagement Initialized
  Name: <engagement-name>
  OPSEC: <profile>
═══════════════════════════════════════════

  Files Created:
    [+] engagement.json
    [+] CLAUDE.md
    [+] README.md
    [+] scope.md
    [+] targets.jsonl
    [+] .gitignore

  Active Plugins: <list>
  Targets: <count>
  Tools: <status>

  Next Steps:
    <goal-specific first commands>
═══════════════════════════════════════════

Suggest next steps based on the goals:

• **Pentest**: `/recon <target>` → `/planner` → `/campaign next`
• **OSINT**: `/wr-target <person>` → `/wr-dossier` → `/wr-report`
• **Leak hunting**: `/ty-hunt <target>` → `/ty-classify` → `/ty-acquire`
• **Reverse engineering**: `/analyze <binary>` → `/decompile` → `/secrets`
• **Hardening**: `/op-harden` → `/op-vps` → `/op-proxy`