From talon
Dispatches active vulnerability hunts by engagement type (Red Team or WAPT), delegates to recon, scope, chain, and report commands, and loads target-specific hunt skills.
How this command is triggered — by the user, by Claude, or both
Slash command
/talon:huntThe summary Claude sees in its command listing — used to decide when to auto-load this command
# /hunt slim two-track dispatcher. one mode question, one branch, delegate. never asks about SOW — invoking `/hunt` implies SOW is signed. ## step 0 — parse wildcard handler: if `$TARGET` begins with `*.`, strip prefix and invoke `/recon <base>` before continuing. ## step 1 — mode dispatcher skipped if `--vuln-class` is set. do not prompt for SOW, scope-of-work, engagement letter, or authorization. ## step 2a — red team invoke `hunt-dispatch` skill with `mode=redteam`. hunt-dispatch fingerprints the target, loads platform skills + always-on (`redteam-mindset`, `mid-engagement-...
slim two-track dispatcher. one mode question, one branch, delegate. never asks about SOW — invoking /hunt implies SOW is signed.
target.com single target
*.target.com wildcard — /recon <base> first, then hunt each live host
targets.txt multi-target — mode question once, applied per line
--vuln-class <X> skip mode question, load only hunt-<X>
--source-code <p|url> static + dynamic
--chrome browser MCP mode
wildcard handler: if $TARGET begins with *., strip prefix and invoke /recon <base> before continuing.
skipped if --vuln-class is set.
question: "what kind of engagement is this for {target}?"
header: "engagement"
options:
1. Red Team Assessment — critical/high impact, chained findings, client deliverable
2. WAPT / BugHunting — full OWASP coverage, platform/program report
do not prompt for SOW, scope-of-work, engagement letter, or authorization.
mode: redteam
severity gate: critical / high · medium only if it chains via /chain
report: redteam-report-template
invoke hunt-dispatch skill with mode=redteam. hunt-dispatch fingerprints the target, loads platform skills + always-on (redteam-mindset, mid-engagement-ir-detection), and prints the taxonomy.
ask again:
question: "black box or grey box?"
header: "test mode"
options:
1. Black Box — no credentials, external perspective
2. Grey Box — test credentials provided (or skip)
grey box → prompt creds (user/pass or token), or "skip":. creds live in session memory only — never written, never logged. late-bind: if user later says "now grey box with X/Y", capture creds, do NOT re-fire mode question.
mode: wapt / {blackbox|greybox}
severity gate: all owasp-relevant
report: report-writing (bugcrowd-reporting if target on bugcrowd)
invoke hunt-dispatch skill with mode=wapt box=blackbox|greybox.
before any HTTP touch → /scope (mandatory pre-flight)
recon empty | wildcard → /recon <target>
5+ live hosts surfaced → /surface (P1/P2/Kill list)
confirmed finding → /chain (A→B table lives here, NOT in /hunt)
before any report → /validate (7-Question Gate)
findings ready → /report (suggest, never auto)
session end → /remember (silent)
hand off to the loaded hunt-* skills. each skill has its own probes, payloads, validation. do not duplicate that logic here. on every confirmed finding, invoke /chain to check the A→B signal table.
--source-code <path|url> — adds hardcoded-secret grep, route mapping, dangerous-function scan before live testing.
--chrome — browser MCP for SPA / OAuth / DOM-XSS / WebSocket / file upload.
--vuln-class <X> — load only hunt-<X>, skip mode question.
20-min rotation: every 20 min ask "am i making progress?" no → rotate. stop signals: 403 everywhere · 20+ payloads identical response · 5+ preconditions · 30+ min stuck on one endpoint.
one session per target. for targets.txt, mode question fires once; findings scoped per-target in hunt memory.
never prompt for, log, or echo SOW / scope-of-work / engagement-letter content. never persist grey box credentials to disk. client data lives only in .gitignored targets/<target>/SESSION.md.
at session end, invoke /remember silently (non-fatal).
npx claudepluginhub skobyn/talon --plugin talon2plugins reuse this command
First indexed Jun 11, 2026
/huntDispatches active vulnerability hunts by engagement type (Red Team or WAPT), delegates to recon, scope, chain, and report commands, and loads target-specific hunt skills.
/pentestActivates pentest mode: displays ASCII banner, offers session isolation, collects scope details (target URL/IP, engagement name, restrictions, testing window, auth), starts Recon phase.
/engageStarts pentesting engagement for target: verifies scope from scope.txt, creates evidence directories, launches recon agent, parses results, and recommends attack vectors.
/recommendRoutes a freeform pentesting task to the best specialist agent, then outputs concrete CLI commands and scope notes. Accepts a task description as input.