{
  "slug": "hunt-intake",
  "name": "Hunt workspace intake",
  "category": "Research",
  "summary": "Start an authorized hunt as a portable, local project with scope, rules, and evidence boundaries recorded before work begins.",
  "scope": "Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.",
  "inputs": [
    "User-supplied scope and rules references",
    "Local workspace location",
    "Approved accounts, environments, and evidence constraints"
  ],
  "review": [
    {
      "title": "Create the local boundary",
      "body": "When a local Hunt Workbench is available, call init_hunt_workspace with the user-supplied scope and rules references. Keep its data and credentials in the selected local workspace."
    },
    {
      "title": "Separate discovery from authorization",
      "body": "Record known assets as inventory. A hostname, URL, or technology fingerprint found during recon does not add permission to test it."
    },
    {
      "title": "Set evidence rules",
      "body": "Decide which owned accounts and redacted artifacts can support a check. Use hosted get_research_context, search_research, or get_research_record only for public citations."
    }
  ],
  "outputs": [
    "Local workspace with scope references",
    "Authorization and evidence boundary",
    "Initial inventory marked separately from scope"
  ],
  "pitfalls": [
    "Treating discovery as authorization",
    "Sending private scope or evidence to the hosted MCP",
    "Starting checks before rules are recorded"
  ],
  "mcp": {
    "hosted": [
      "get_research_context",
      "search_research",
      "get_research_record"
    ],
    "workbench": [
      "init_hunt_workspace",
      "search_hunt_records"
    ]
  },
  "references": {
    "resources": [
      {
        "id": "owasp-threat-modeling-assumptions-and-validation",
        "title": "OWASP Threat Modeling: system assumptions and mitigation validation",
        "url": "https://vulns.co/research/resources/owasp-threat-modeling-assumptions-and-validation/"
      },
      {
        "id": "owasp-secure-code-review-methodology",
        "title": "OWASP Secure Code Review: baseline and change-focused review",
        "url": "https://vulns.co/research/resources/owasp-secure-code-review-methodology/"
      }
    ],
    "diagrams": [
      {
        "id": "workload-identity-tenant-scope",
        "title": "Keep workload authority tenant-scoped",
        "url": "https://vulns.co/research/diagrams/workload-identity-tenant-scope/"
      }
    ],
    "reports": [
      {
        "id": "meta-service-identity-secrets-trust-boundary-2026",
        "title": "Meta service-identity exposure amplified by excessive secret access",
        "url": "https://vulns.co/research/reports/meta-service-identity-secrets-trust-boundary-2026/"
      },
      {
        "id": "google-actifio-driver-service-identity-isolation-2025",
        "title": "Actifio driver execution exposed excessive shared-service authority",
        "url": "https://vulns.co/research/reports/google-actifio-driver-service-identity-isolation-2025/"
      }
    ]
  },
  "provenance": {
    "publisher": "vulns.co / GK Data",
    "guide_updated": "2026-10-12",
    "library_as_of": "2026-10-04",
    "library_commit": "d5550c7891119cf1379e235721541c947850a3b3"
  },
  "url": "https://vulns.co/skills/hunt-intake/",
  "markdown_url": "https://vulns.co/skills/hunt-intake/SKILL.md"
}