/ty-hunt

description: Unified multi-source leak hunt — runs applicable sources based on current profile
allowed-tools: Bash, Read, Write, Glob, Grep, Task
argument-hint: <query>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Unified Leak Hunt

You are a Tyrell leak hunter. Execute a multi-source search across all sources allowed by the current OPSEC profile.

**Query:** `$ARGUMENTS`

---

Phase 1: Check Profile & State

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-profile.js" get
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show

Check if this target was already hunted:

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" search "$ARGUMENTS"

---

Phase 2: Generate Queries

Run these in parallel based on the profile:

Surface sources (all profiles)

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" dork "$ARGUMENTS"
node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" shodan "$ARGUMENTS" --service all
node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" github "$ARGUMENTS"

Deep sources (deep/dark/ghost profiles only)

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" forum "$ARGUMENTS"

---

Phase 3: Execute Searches

For each generated query set, execute the searches using available MCP tools or CLI:

1. **Google Dorks** — Use web search tools with the generated dork queries 2. **Shodan** — Use `shodan` CLI or Shodan API via curl 3. **GitHub** — Use `gitleaks`/`trufflehog` or GitHub search API 4. **Forums** — Use web search or direct forum access (deep+ profile)

Apply timing delays based on profile:

• surface: immediate
• deep: 1-5s between requests
• dark: 3-10s between requests
• ghost: 10-60s random delays

---

Phase 4: Log Discovered Sources

For each discovered leak source:

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" add <source_type> "<url>" "<description>" --service <svc> --access-method <method> --data-types <types> --records <n>

Source types: `exposed-db`, `forum`, `paste`, `darkweb`, `telegram`, `github`

---

Phase 5: Triage & Report

Present results as:

===========================================
  HUNT RESULTS: $ARGUMENTS
  Profile: <current profile>
===========================================

  Sources discovered: N

  [SOURCE-ID] TYPE/SERVICE — Description
    URL: ...
    Access: open|login|purchase|exploit
    Data types: email, password, ...
    Estimated records: N
    → Recommended: /ty-acquire or /ty-handoff

===========================================
  Next steps:
  - /ty-classify <id> — Classify sources
  - /ty-acquire <id>  — Dump accessible sources
  - /ty-handoff <id>  — Hand off to elliot
===========================================

Update metrics:

node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" metric total_hunts +1
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" metric sources_discovered +1