/ty-campaign
Resume or execute a leak hunting campaign with progress tracking
$ npx -y skills add ogrodev/fsociety --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/ty-campaign
Context preview
What this command does when you run it.
Resume or execute a leak hunting campaign with progress tracking
Command definition
ty-campaign.mddescription: Resume or execute a leak hunting campaign with progress tracking
allowed-tools: Bash, Read, Write, Glob, Grep, Task, AskUserQuestion
argument-hint: [resume|status|next|complete-step|complete-phase|reset|note <text>]
> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.
Hunt Campaign Runner (Orchestrator)
You are a **lean orchestrator**. Read state, determine the next action, spawn fresh executor subagents for heavy work, and update state with results.
**Context budget: YOU stay under 30%. Each executor gets 100% fresh.**
The user's argument: `$ARGUMENTS`
---
State Tool Reference
All state commands: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" <command>`
Key commands:
- `show` — full state
- `smart-resume` — JSON next-action analysis
- `set-step <n> [total] --action "<desc>"` — set current step
- `complete-step --summary "<text>" --result "<type>" --findings <n>`
- `complete-phase --summary "<text>"`
- `track-agent <id> <type> <task>` / `complete-agent <id> --result "<text>"`
- `add-note <text>` / `add-decision <text>` / `add-blocker <text>`
- `metric <key> +1`
---
Dispatch
`status` or no arguments
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show`resume`
1. Run: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" smart-resume` 2. Parse JSON. Check `.continue-here.md`. 3. Present highest-priority action and ask to proceed. 4. Delete `.continue-here.md` after resuming.
`next`
Execute next step via **executor subagent pattern**:
1. Read plan file (Glob `plan-*.md`, `PLAN.md`) 2. Get state: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show` 3. Check for duplicates: `node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" search "<keywords>"` 4. Set step: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" set-step <n> <total> --action "<desc>"` 5. Track agent: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" track-agent "<id>" "executor" "<task>"` 6. Spawn fresh Task subagent with step context 7. Collect results, complete agent, complete step, update metrics 8. Check for pivots 9. Report and ask: continue or pause?
`complete-step`
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" complete-step --summary "$ARGUMENTS"`complete-phase`
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" complete-phase --summary "$ARGUMENTS"`reset`
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" reset`note <text>`
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" add-note "$ARGUMENTS"---
Executor Subagent Prompt Template
You are a Tyrell hunt executor. Execute this single campaign step and report back.
STEP: {step number} of {total}
ACTION: {what to do}
CAMPAIGN: {campaign name}
OBJECTIVE: {objective}
CONTEXT:
- Profile: {current hunt profile}
- Previous step: {result}
- Known blockers: {blockers}
INSTRUCTIONS:
1. Execute the hunt action using appropriate tools
2. For each discovered source, run:
node "{CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" add <type> "<url>" "<desc>" --service <svc>
3. For accessible sources, probe with:
node "{CLAUDE_PLUGIN_ROOT}/scripts/dumper.js" probe <url>
REPORT BACK:
RESULT: success | partial | blocked | failed
SOURCES_FOUND: <number>
SUMMARY: <one-line summary>
PIVOT_DETECTED: <description or "none">
NEXT_RECOMMENDATION: <suggestion>Read more
description: Resume or execute a leak hunting campaign with progress tracking allowed-tools: Bash, Read, Write, Glob, Grep, Task, AskUserQuestion argument-hint: [resume|status|next|complete-step|complete-phase|reset|note <text>]
> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.
Hunt Campaign Runner (Orchestrator)
You are a **lean orchestrator**. Read state, determine the next action, spawn fresh executor subagents for heavy work, and update state with results.
**Context budget: YOU stay under 30%. Each executor gets 100% fresh.**
The user's argument: `$ARGUMENTS`
---
State Tool Reference
All state commands: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" <command>`
Key commands:
- `show` — full state
- `smart-resume` — JSON next-action analysis
- `set-step <n> [total] --action "<desc>"` — set current step
- `complete-step --summary "<text>" --result "<type>" --findings <n>`
- `complete-phase --summary "<text>"`
- `track-agent <id> <type> <task>` / `complete-agent <id> --result "<text>"`
- `add-note <text>` / `add-decision <text>` / `add-blocker <text>`
- `metric <key> +1`
---
Dispatch
`status` or no arguments
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show`resume`
1. Run: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" smart-resume` 2. Parse JSON. Check `.continue-here.md`. 3. Present highest-priority action and ask to proceed. 4. Delete `.continue-here.md` after resuming.
`next`
Execute next step via **executor subagent pattern**:
1. Read plan file (Glob `plan-*.md`, `PLAN.md`) 2. Get state: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show` 3. Check for duplicates: `node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" search "<keywords>"` 4. Set step: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" set-step <n> <total> --action "<desc>"` 5. Track agent: `node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" track-agent "<id>" "executor" "<task>"` 6. Spawn fresh Task subagent with step context 7. Collect results, complete agent, complete step, update metrics 8. Check for pivots 9. Report and ask: continue or pause?
`complete-step`
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" complete-step --summary "$ARGUMENTS"`complete-phase`
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" complete-phase --summary "$ARGUMENTS"`reset`
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" reset`note <text>`
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" add-note "$ARGUMENTS"---
Executor Subagent Prompt Template
You are a Tyrell hunt executor. Execute this single campaign step and report back.
STEP: {step number} of {total}
ACTION: {what to do}
CAMPAIGN: {campaign name}
OBJECTIVE: {objective}
CONTEXT:
- Profile: {current hunt profile}
- Previous step: {result}
- Known blockers: {blockers}
INSTRUCTIONS:
1. Execute the hunt action using appropriate tools
2. For each discovered source, run:
node "{CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" add <type> "<url>" "<desc>" --service <svc>
3. For accessible sources, probe with:
node "{CLAUDE_PLUGIN_ROOT}/scripts/dumper.js" probe <url>
REPORT BACK:
RESULT: success | partial | blocked | failed
SOURCES_FOUND: <number>
SUMMARY: <one-line summary>
PIVOT_DETECTED: <description or "none">
NEXT_RECOMMENDATION: <suggestion>Multi-plugin marketplace for Claude Code offensive security plugins
Repo: ogrodev/fsociety
Other commands on fsociety.
- /apiscan
API security audit — REST, GraphQL, JWT analysis, parameter discovery
Open command - /archives
Archive or list previous engagement snapshots
Open command - /bruteforce
Password brute force and hash cracking against target services
Open command - /campaign
Resume or execute an attack campaign with progress tracking
Open command - /dashboard
Show running scans, system health, and engagement status
Open command - /debrief
Post-engagement lessons learned analysis and debrief report
Open command

