/ty-forums

description: Search breach forums for leak postings and database offers
allowed-tools: Bash, Read, Glob, Grep
argument-hint: <query>

You are executing a breach forum search for the tyrell data exfiltration plugin.

Step 1 — Profile Gate Check

Before proceeding, verify that the active operational profile meets the minimum access tier:

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" forum --check-profile $ARGUMENTS

If the profile is `surface` or `light`, stop immediately and inform the operator:

> Forum hunting requires a **deep** or higher operational profile. Switch profiles before continuing.

Proceed only if the profile is `deep`, `dark`, or `ghost`.

Step 2 — Generate Forum Search Queries

Run the hunt engine to produce optimized forum search queries:

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" forum $ARGUMENTS

The script returns a list of query objects with fields: `forum`, `query`, `keywords`, and `thread_patterns`. Common forums include RaidForums archives, BreachForums, Exploit.in, XSS.is, and dedicated leak channels.

Step 3 — Execute Forum Searches

For each forum and query combination, search via available tooling:

• **Via MCP web search**: Submit targeted queries with site-specific operators (e.g., `site:forum-url "<keyword>"`).
• **Via direct HTTP** (if forum is accessible on clearnet):

  curl -s -A "Mozilla/5.0" -H "Cookie: ${FORUM_SESSION_COOKIE}" \
    "https://<forum>/search?q=<query>" | grep -oP '(?<=href=")[^"]+thread[^"]+'

• Record thread URLs, post dates, post authors, and any attached sample files or torrent links.

Step 4 — Extract Leak Metadata

For each promising thread or post found, extract structured metadata:

• **Target organization**: Which entity's data is being sold or shared
• **Record count**: How many records (if stated)
• **Data fields**: What columns are included (emails, passwords, PII, financial)
• **Date of breach**: When the breach occurred (vs. when it was posted)
• **Price or access requirement**: Free, paid, traded, or escrow
• **Sample availability**: Whether a sample is posted for verification
• **Seller reputation**: Forum post count, vouches, verified tags

Step 5 — Log Findings

For each relevant post or thread:

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" add \
  --type forum \
  --url "<thread-url>" \
  --forum "<forum-name>" \
  --target "<organization-or-domain>" \
  --records "<estimated-count>" \
  --fields "<data-fields>" \
  --notes "<seller-reputation-and-sample-info>"

Step 6 — Present Results

Output a structured forum intelligence report:

Active Listings

| Source ID | Forum | Target | Records | Fields | Date | Price | |-----------|-------|--------|---------|--------|------|-------| | ... | ... | ... | ... | ... | ... | ... |

Archived / Historical Leaks

• List any confirmed historical leaks relevant to the query

Flag any listings with verified samples or high-reputation sellers for priority follow-up using `/ty-classify` and `/ty-acquire`.