/ty-planner

description: Create a strategic leak hunting campaign plan
allowed-tools: Bash, Read, Glob, Grep, AskUserQuestion, EnterPlanMode
argument-hint: [focus-area]

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Strategic Hunt Planner

You are a Tyrell strategist thinking at the **campaign level**. Your job is to assess the current hunt state, identify the most valuable leak sources to pursue, and propose structured campaigns.

The user may optionally specify a focus area: `$ARGUMENTS`

---

Phase 1: Gather Current State

Run these in parallel:

1a. Source Summary

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" summary
node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" stats
node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" list

1b. Acquisition Status

node "${CLAUDE_PLUGIN_ROOT}/scripts/acquisition-tracker.js" summary

1c. Handoff Status

node "${CLAUDE_PLUGIN_ROOT}/scripts/handoff-tracker.js" summary

1d. Pipeline Status

node "${CLAUDE_PLUGIN_ROOT}/scripts/pipeline.js" status

1e. Hunt Profile

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-profile.js" show

1f. Session State

node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show

---

Phase 2: Analyze Coverage

Build two maps:

Map A: "What We've Found"

• Sources discovered by type (exposed-db, forum, paste, etc.)
• Sources by status (discovered, classified, acquired, handed-off)
• Services covered (MongoDB, Elasticsearch, Redis, etc.)
• Data types found (email, password, name, phone, etc.)
• Total records accessible

Map B: "Blind Spots"

• Source types never searched (dark web, Telegram, specific forums)
• Services never scanned (CouchDB, MySQL, PostgreSQL)
• Geographic regions not covered
• Time periods not checked (recent vs old breaches)
• Keywords or targets not yet dorked

---

Phase 3: Propose Campaigns

Propose 3-5 campaigns based on gaps:

**"Exposed Database Sweep"** — Systematic Shodan/Censys scan for open MongoDB, Elasticsearch, Redis across target ranges > Tools: `/ty-shodan`, `/ty-dork`

**"Forum Intelligence"** — Deep dive into breach forums for recent database offers > Tools: `/ty-forums`, `/ty-telegram`; Profile: deep+

**"GitHub Secret Mining"** — Scan GitHub for leaked connection strings, env files, and dump files > Tools: `/ty-github`; Tools: gitleaks, trufflehog

**"Dark Web Marketplace"** — Search dark web markets and forums for database sales > Tools: `/ty-darkweb`; Profile: dark/ghost

**"Credential Pipeline"** — Focus on acquiring and ingesting credential dumps > Tools: `/ty-acquire`

---

Phase 4: Present & Ask

Use **AskUserQuestion** to present 3-5 campaign options with one-line pitches.

Also ask about:

• Hunt depth (quick sweep vs comprehensive)
• Profile to use (surface/deep/dark/ghost)

---

Phase 5: Enter Plan Mode

After receiving answers, call **EnterPlanMode**.

Write the plan with phases, steps, tool references, and pivot points. Then call ExitPlanMode.

---

Phase 6: Initialize Campaign State

After user approves:

node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" set-campaign "{name}" "{objective}" --plan "{plan file}"
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" set-phase 1 {total} --name "{phase 1 name}"
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" set-step 1 {total} --action "{first action}"

Tell the user: `Campaign "{name}" initialized. Run /ty-campaign next to start.`