Claude commands

Show ranked attack surface for a target from its recon manifest + hunt memory. Deterministic backing is cbh surface <target> (reads recon/

Mandatory pre-flight scope check — verify an asset is in scope BEFORE any HTTP touch. Deterministic (deny-wins, default-deny) via engine/scope.py against the engagement's scope.md. Blocks out-of-scope testing. Usage: /scope

Write a submission-ready bug bounty report. Generates H1/Bugcrowd/Intigriti/Immunefi format with CVSS 3.1 score, proof of concept, impact statement, and remediation. Run /validate first. Usage: /report

Optional manual note on a target or the last confirmed finding. Capture is automatic during autopilot; this is for extra context. Usage: /remember

Run full recon pipeline on a target — subdomain enum (Chaos API + subfinder), live host discovery (dnsx + httpx), URL crawl (katana + waybackurls + gau), gf pattern classification, nuclei scan. Outputs to recon/

Pick up a previous hunt on a target — shows hunt history and untested surface from the autopilot ledger. Usage: /pickup target.com

Inspect or rotate the autopilot ledger JSONL files (findings.jsonl, negatives.jsonl). Caps file size and keeps N rotated backups so memory does not grow unbounded.

On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Pulls NVD/GitHub-Advisory CVEs + bundled disclosed reports + hunt memory context. Usage: /intel target.com

Active vulnerability hunting. Two-track dispatcher — asks Red Team vs WAPT, hands off to hunt-dispatch skill and sibling commands. Usage: /hunt target.com | /hunt *.target.com | /hunt targets.txt [--vuln-class X] [--source-code P] [--chrome]

Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain

Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]

Show or configure the compact Fallow Impact statusline in Claude Code

GAIA-wrapped /speckit-specify: writes through core, then relocates the artifact to .gaia/local/specs/SPEC-NNN/SPEC.md and stamps GAIA frontmatter.

This project uses the GAIA preset. Bare /speckit-clarify is not the clarify path here: core clarify writes an off-shape artifact (a ## Clarifications / ### Session block with five-word answers) and carries a question cap GAIA does not use. Run /gaia-spec instead — it driv

Promote merged SPEC or plan content into the GAIA wiki.

GAIA before_implement hook: render PO-authored UATs into Playwright e2e specs at .playwright/e2e/spec-NNN/.

GAIA Socratic discovery wrapper: /speckit-specify for the initial draft, then GAIA's own Socratic clarify loop.

Close a SPEC after implementation+merge. Optional drain of deferred wiki-promote, cold-consolidates an out-of-band merge into SUMMARY.md, then early-reaps the local SPEC folder once cost is represented in cost.jsonl.

GAIA self-review: pre-gate-2 review pass on the in-progress SPEC draft.

Close a plan after implementation+merge. Offers wiki-promote for the plan's consolidated SUMMARY.md, cold-consolidates an out-of-band merge, then early-reaps the local plan folder once cost is represented in cost.jsonl.

GAIA after_specify hook: immutability lint over the just-written SPEC artifact.

GAIA before_specify hook: constitution placeholder check + spec-kit version-pin drift detection.

Single post-init onboarding command; detects situation, runs only owed phases; safe to re-run. --reconfigure rotates token and re-selects tools.

Maintainer-only autonomous health audit + auto-heal loop. Runs N=3 fresh-team audit-fix-audit cycles with circuit breakers, reports an F-to-A+ verdict (folding in the shared Claude-integration fitness grade) or escalates.