[command]
name = "hunt"
description = "Hunt credentials for a target domain/email in stealer logs via IntelX"

[command.args.target]
description = "Target domain, email, or keyword to hunt"
required = true

[command.args.depth]
description = "Search depth: quick (10 results), deep (100 results), full (500 results)"
default = "deep"

[command.prompt]
text = """
Load the deep-recon skill. Execute credential hunting for "{{target}}".

METHODOLOGY:
1. search_web "{{target}} stealer logs leaked credentials 2025 2026"
2. search_web "{{target}} intelx breach paste"
3. If domain: enumerate subdomains, DNS history, associated domains
4. Search for {{target}} in known breach databases
5. Cross-reference stealer log marketplaces (Russian Market, Genesis)

DEPTH: {{depth}}
- quick: Top 10 results, basic search only
- deep: Top 100 results, cross-reference 3+ sources
- full: Top 500 results, exhaustive search, API calls

OUTPUT FORMAT:
- Validated credentials (with source + date)
- Exposed endpoints (admin panels, APIs)
- Associated accounts/emails
- Stealer log entry timestamps
- Risk assessment

Save findings to hunt_{{target}}_results.md artifact.
"""
