/ty-classify

description: Classify a discovered leak source with credibility, freshness, and access method
allowed-tools: Bash, Read, AskUserQuestion
argument-hint: <source-id>

You are classifying a discovered data source for the tyrell data exfiltration plugin.

Step 1 — Retrieve Source Details

Look up the source in the source-tracker to display its current metadata:

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" list --id $ARGUMENTS

Display the full source record to the operator:

• Source ID, type, URL/host
• Discovery method and timestamp
• Any notes recorded at discovery time
• Current classification status (likely `unclassified`)

Step 2 — Gather Classification Input

Ask the operator a series of classification questions. Ask them all at once to avoid multiple round-trips:

Ask: "Please classify this source across the following dimensions:

**1. Credibility** — How confident are you that this source contains real, non-fabricated data?

• `unverified` — No sample seen, source claim only
• `low` — Sample seen but unconfirmed (could be synthetic)
• `medium` — Sample partially verified against known-good data
• `high` — Sample verified against live target or known breach
• `confirmed` — Fully verified, matches known breach event

**2. Freshness** — How recent is the data?

• `unknown` — Date not determinable
• `stale` — Older than 2 years
• `aged` — 6 months to 2 years old
• `recent` — Less than 6 months old
• `fresh` — Less than 30 days old

**3. Access Method** — How is the data accessible?

• `open` — Publicly accessible without authentication
• `registration` — Requires free account/registration
• `purchase` — Requires payment (specify amount in notes)
• `trade` — Available via data exchange/trade
• `exploit` — Requires active exploitation to retrieve
• `physical` — Requires physical access

**4. Data Sensitivity** — What is the highest-sensitivity data type present?

• `public` — Already public information
• `pii` — Personal identifiable information (names, emails, phones)
• `credentials` — Username/password pairs
• `financial` — Payment card or banking data
• `health` — Medical or health records
• `government` — Government or law enforcement data

**5. Estimated Record Count** — How many records does this source contain? (Enter a number or range, e.g. '50000' or '1M-5M')

**6. Notes** — Any additional context about this source?"

Step 3 — Run Classification

Once the operator provides all answers, run the source-tracker classification command:

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" classify \
  --id "<source-id>" \
  --credibility "<credibility>" \
  --freshness "<freshness>" \
  --access-method "<access-method>" \
  --sensitivity "<data-sensitivity>" \
  --records "<estimated-count>" \
  --notes "<additional-notes>"

Step 4 — Display Classification Summary

After successful classification, display a formatted summary:

SOURCE CLASSIFICATION REPORT
=============================
Source ID   : <id>
Type        : <type>
URL/Host    : <url>

CLASSIFICATION
--------------
Credibility   : <value>
Freshness     : <value>
Access Method : <value>
Sensitivity   : <value>
Est. Records  : <value>

RECOMMENDED NEXT STEPS
-----------------------

Based on the classification values, recommend next steps:

• If `credibility >= medium` and `access-method` is `open` or `registration`: Suggest `/ty-acquire <source-id>` immediately.
• If `credibility` is `unverified` and a sample is gettable: Suggest verifying a sample first.
• If `access-method` is `purchase` or `trade`: Note the cost/exchange requirement and suggest planning acquisition.
• If `sensitivity` is `financial` or `health`: Flag for heightened operational security.
• If the source is relevant to a known target: Suggest `/ty-handoff <source-id>` for elliot integration.