/ty-acquire

description: Acquire and dump data from an accessible leak source
allowed-tools: Bash, Read, Write
argument-hint: <source-id>

You are executing a data acquisition operation for the tyrell data exfiltration plugin.

Step 1 — Retrieve Source Record

Look up the source to confirm it is ready for acquisition:

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" list --id $ARGUMENTS

Verify the following before proceeding:

• The source has been classified (`credibility` is not `unclassified`)
• The `access-method` is one that can be executed (not `physical`)
• For `exploit` access method: confirm you have an active shell or exploitation context
• For `open` or `registration`: confirm connectivity to the host

If the source is unclassified, instruct the operator to run `/ty-classify <source-id>` first.

Step 2 — Probe the Source

Run the dumper probe to assess the target before full acquisition:

node "${CLAUDE_PLUGIN_ROOT}/scripts/dumper.js" probe \
  --source-id "<source-id>"

The probe will attempt to:

• Confirm the service is reachable
• Enumerate accessible databases, collections, or indices
• Estimate record counts and data sizes
• Identify available fields and schema
• Test for authentication requirements

Review the probe output carefully. Confirm with the operator before proceeding to full dump if the estimated data volume is large (>1GB).

Step 3 — Execute the Dump

Run the full data acquisition:

node "${CLAUDE_PLUGIN_ROOT}/scripts/dumper.js" dump \
  --source-id "<source-id>"

The dumper will handle service-specific extraction:

• **MongoDB**: `mongodump` or direct `find()` queries via `mongosh`
• **Elasticsearch**: Scroll API iteration across all index shards
• **Redis**: `KEYS *` + `TYPE`/`GET`/`HGETALL` enumeration or `BGSAVE` + RDB download
• **CouchDB**: `_all_docs` with `include_docs=true` across all databases
• **PostgreSQL / MySQL**: `mysqldump` / `pg_dump` or direct `SELECT` export to CSV
• **HTTP/file endpoint**: `wget` or `curl` with rate limiting and resumption

Progress will be streamed. Dumped data is written to `${CLAUDE_PLUGIN_ROOT}/data/dumps/<source-id>/`.

Step 4 — Verify Dump Integrity

After the dump completes, verify the output:

node "${CLAUDE_PLUGIN_ROOT}/scripts/dumper.js" verify \
  --source-id "<source-id>"

This checks: file count, total size, record count (for structured formats), and SHA256 hash of each output file. Mismatches between probe estimates and actual dump counts should be noted.

Step 5 — Log Acquisition

Record the acquisition in the acquisition tracker:

node "${CLAUDE_PLUGIN_ROOT}/scripts/acquisition-tracker.js" add \
  --source-id "<source-id>" \
  --dump-path "${CLAUDE_PLUGIN_ROOT}/data/dumps/<source-id>/" \
  --record-count "<actual-count>" \
  --size-bytes "<total-size>" \
  --status "complete" \
  --notes "<any anomalies or observations>"

Step 6 — Present Acquisition Summary

Display a structured acquisition report:

ACQUISITION COMPLETE
====================
Source ID     : <id>
Dump Path     : ${CLAUDE_PLUGIN_ROOT}/data/dumps/<source-id>/
Total Records : <count>
Total Size    : <size>
Duration      : <elapsed>
Integrity     : <pass|fail>

FILES
-----
<list of dump files with sizes and SHA256 hashes>

SCHEMA PREVIEW
--------------
<first 5 field names and sample values from first record>

Step 7 — Recommend Next Steps

Based on the acquired data:

• If the dump is relevant to a specific target's infrastructure: Suggest `/ty-handoff <source-id>` for elliot.
• If the data volume is large: Suggest compressing with `tar czf` before further handling.