[command]
name = "intel"
description = "Daily threat intel gathering — CVEs, exploits, underground activity"

[command.args.focus]
description = "Intel focus: cve (new vulns), underground (tools/markets), all"
default = "all"

[command.args.days]
description = "Look back period in days"
default = "1"

[command.prompt]
text = """
Execute daily intelligence gathering. Focus: {{focus}}, Period: last {{days}} day(s).

SOURCES (search all):
1. search_web "critical vulnerability CVE 2026 March RCE"
2. search_web "new exploit POC github 2026"
3. search_web "supply chain attack package compromise 2026"
4. search_web "wordpress vulnerability critical 2026"
5. search_web "CISA KEV catalog new additions March 2026"

FOR UNDERGROUND FOCUS:
6. search_web "new infostealer malware 2026"
7. search_web "phishing kit MFA bypass 2026"
8. search_web "ransomware group new victim 2026"

CROSS-REFERENCE WITH:
- predator skill CVE database → identify NEW vulns not in our DB
- underground-tools skill → identify NEW tools not cataloged
- supply-chain-attack skill → identify NEW attack methods

OUTPUT: daily_intel artifact with:
- New CVEs (severity, affected, POC available?)
- New underground tools/services
- New attack methods or techniques
- Recommendations for D1337 arsenal updates
- Which skills need updating
"""
