Map available telemetry, query surfaces, tenants, retention windows, and investigation blind…
EnglishInitialize a threat hunting case from a signal, detection, intel lead, or analyst…
EnglishInitialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution…
EnglishCreate phase plans for a threat hunt with exact telemetry tasks, receipts, and query…
EnglishExecute a hunt phase with parallel telemetry work, query logging, receipt generation, and optional wave…
EnglishTurn a signal into testable hunt hypotheses, scope, datasets, and success…
EnglishValidate hunt conclusions against receipts, contradictory evidence, and success…
EnglishCross-phase audit of all outstanding Evidence Review and findings validation…
EnglishPost-mortem investigation for failed THRUNT workflows — analyzes git history, artifacts, and state to diagnose what went…
EnglishIncludes Hunt Map Environment, Hunt New Case, Hunt New Program, and other workflows.
Supported by the Atlas install prompt. Skill-specific requirements vary.
Pack stats
What’s included
Hunt Help
Show available THRUNT threat hunting commands and artifact layout
Hunt Map Environment
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Hunt New Case
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Hunt New Program
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Hunt Plan
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Hunt Publish
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Hunt Run
Execute a hunt phase with parallel telemetry work, query logging, receipt generation, and optional wave targeting
Hunt Shape Hypothesis
Turn a signal into testable hunt hypotheses, scope, datasets, and success criteria
Hunt Validate Findings
Validate hunt conclusions against receipts, contradictory evidence, and success criteria
Thrunt Add Backlog
Add an idea to the backlog parking lot (999.x numbering)
Thrunt Add Phase
Add phase to end of current milestone in huntmap
Thrunt Add Tests
Generate tests for a completed phase based on Evidence Review criteria and implementation
Thrunt Add Todo
Capture idea or task as todo from current conversation context
Thrunt Audit Evidence
Cross-phase audit of all outstanding Evidence Review and findings validation items
Thrunt Audit Milestone
Audit milestone completion against original intent before archiving
Thrunt Autonomous
Run all remaining phases autonomously — discuss→plan→execute per phase
Thrunt Cleanup
Archive accumulated phase directories from completed milestones
Thrunt Complete Milestone
Archive completed milestone and prepare for next version
Thrunt Debug
Systematic debugging with persistent state across context resets
Thrunt Do
Route freeform text to the right hunt or THRUNT command automatically
Thrunt Fast
Execute a trivial task inline — no subagents, no planning overhead
Thrunt Forensics
Post-mortem investigation for failed THRUNT workflows — analyzes git history, artifacts, and state to diagnose what went wrong
Thrunt Health
Diagnose planning directory health and optionally repair issues
Thrunt Help
Show available THRUNT commands and usage guide
Showing 24 of 57 skills. Use the list’s page controls above to explore the rest.
Quick start
- Choose your skills. Select individual skills above, or choose the entire pack.
- Copy the install prompt. Use Copy install prompt above the list.
- Send it to your agent. Paste into your coding agent’s chat. Your agent reviews the source and guides the setup.
Try it with your agent
After installation, start with a request like:
Use the Hunt Help skill to help with my task.
Ask me for the context you need before getting started.Requirements & license
- A coding agent that can access your project files and install skills.
- Your agent checks each skill’s instructions, dependencies, and permissions during setup.
- Reported license for the skills shown: MIT. The author’s terms apply.