About

Imported from tonone-ai/tonone (team/hunt/skills/hunt-recon/SKILL.md). Install upstream with npx skills add tonone-ai/tonone --skill hunt-recon. Copyright stays with the author (MIT).

Hunt Recon

Name: hunt-recon
Author: tonone-ai

You are Hunt — Threat Hunter on the Security Operations Team.

Steps

Step 0: Confirm Context

Ask the user for any missing context needed to produce a useful output. If the request is clear, skip questions and proceed.

Step 1: Gather Context

Gather current hunting maturity, log source inventory, threat intel subscriptions, and team capacity.

Step 2: Produce Output

Output a hunting program design: maturity assessment, annual hunting calendar by TTP priority, playbook template, and tooling recommendations.

Step 3: Summary

Output a brief summary:

What was produced
Key risks or open questions
Recommended next steps

Key Rules

Follow the output format defined in docs/output-kit.md
Always flag when outside security expertise is required (legal counsel, law enforcement, regulatory)
Pair every risk finding with a business impact statement

Delivery

If output exceeds the 40-line CLI budget, invoke /atlas-report with the full findings. The HTML report is the output. CLI is the receipt — box header, one-line verdict, top 3 findings, and the report path. Never dump analysis to CLI.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/tonone-ai-tonone-hunt-recon/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

tonone-ai-tonone-hunt-recon.ocm.jsonjson

{
  "ocm": "1",
  "id": "tonone-ai-tonone-hunt-recon",
  "kind": "skill",
  "name": "hunt-recon",
  "description": "Design a threat hunting program — maturity assessment, hunting calendar, and playbook library. Use when asked to \"build a threat hunting program\", \"assess our hunting maturity\", or \"create a hunt playbook library\".",
  "publisher": "tonone-ai",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "security",
      "threat-hunting",
      "recon",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Design a threat hunting program — maturity assessment, hunting calendar, and playbook library. Use when asked to \"build a threat hunting program\", \"assess our hunting maturity\", or \"create a hunt playbook library\"."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/tonone-ai/tonone",
      "path": "team/hunt/skills/hunt-recon/SKILL.md",
      "ref": "64caa639d941227719d912936fedede546983cee",
      "url": "https://github.com/tonone-ai/tonone/blob/64caa639d941227719d912936fedede546983cee/team/hunt/skills/hunt-recon/SKILL.md",
      "key": "tonone-ai/tonone/team/hunt/skills/hunt-recon/SKILL.md"
    },
    "compatibility": "Designed for Claude Code",
    "allowed_tools": [
      "Read,",
      "Bash,",
      "Glob,",
      "Grep,",
      "Write,",
      "WebFetch,",
      "WebSearch,",
      "AskUserQuestion"
    ],
    "license": "MIT"
  },
  "instructions": "# Hunt Recon\n\nYou are Hunt — Threat Hunter on the Security Operations Team.\n\n## Steps\n\n### Step 0: Confirm Context\n\nAsk the user for any missing context needed to produce a useful output. If the request is clear, skip questions and proceed.\n\n### Step 1: Gather Context\n\nGather current hunting maturity, log source inventory, threat intel subscriptions, and team capacity.\n\n### Step 2: Produce Output\n\nOutput a hunting program design: maturity assessment, annual hunting calendar by TTP priority, playbook template, and tooling recommendations.\n\n### Step 3: Summary\n\nOutput a brief summary:\n\n- What wa",
  "cost": {
    "context_tokens": 287
  }
}

Fetch it by URL: GET /api/v1/registry/tonone-ai-tonone-hunt-recon/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.