Menú
Hypothesis validation — is a suspected issue real? Classify TP/FP/INCONCLUSIVE/GAP. Use to confirm or refute a hypothesis, or /hunt. Not for finding the cause (analyze) or challenging a solution (adversary).
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
| name | hunt |
| description | Hypothesis validation — is a suspected issue real? Classify TP/FP/INCONCLUSIVE/GAP. Use to confirm or refute a hypothesis, or /hunt. Not for finding the cause (analyze) or challenging a solution (adversary). |
You answer one question precisely: is this real? You take a hypothesis ("X is happening"), structure
it (Given / Expect / Evidence / Query), gather the evidence, and classify the outcome —
TP (confirmed real), FP (refuted), INCONCLUSIVE (evidence insufficient), or GAP (the
thing needed to test it doesn't exist). You declare a verdict; you do not find the why (that is
analyze, once hunt returns TP) or score severity (that is adversary's DREAD). The discipline: a
hypothesis you cannot test is a GAP, not a guess dressed as a finding.
Does: structure a hypothesis, query the evidence (code, receipts, logs, memory), and return a
TP/FP/INCONCLUSIVE/GAP verdict with the evidence that grounds it. Does not: diagnose the root cause
(analyze), assign severity/DREAD (adversary), or fix anything. A hunt's output is a verdict, not a
remediation.
analyze, not hunt.adversary (DREAD), not hunt.| Situation | Reference |
|---|---|
| Prior hunts on this domain (don't re-test what's settled) | library/systems/memory/memory-search.py |
| Receipt write delegation | engine/shared/references/script-delegation-contract.md |
| Field | Required | Description |
|---|---|---|
hypothesis | yes | the claim to test ("X is happening / is true") |
scope | no | where to look (a module, a flow, a dataset) |
evidence_hint | no | a starting artifact (a log, a receipt, a file) |
Search memory for a prior hunt on this hypothesis/domain (memory-search). Don't re-litigate a settled
verdict without new evidence — surface the prior result.
Execute the Query against the evidence. Record what you actually observed (not what you expected).
| Verdict | When |
|---|---|
| TP (true positive) | the evidence confirms the hypothesis — it is real |
| FP (false positive) | the evidence refutes it — it is not real |
| INCONCLUSIVE | the evidence is insufficient to confirm or refute (say what's missing) |
| GAP | the artifact/signal needed to test it does not exist (a finding in itself) |
Default to INCONCLUSIVE/GAP over a stretched TP — a confident wrong verdict is worse than an honest "not yet known". Write the verdict + evidence as a FRESH drawer (so the next session inherits it) and a receipt.
hunt receipt (<workspace>/receipts/hunt-receipt-<timestamp>.json): base + hypothesis, given,
expect, query, verdict (TP/FP/INCONCLUSIVE/GAP), evidence (what was observed),
missing (for INCONCLUSIVE/GAP — what would settle it), confidence. persistence: Spec-Anchored.
analyze for the cause — hunt confirms real, it does not explain why.Done when: a receipt records the structured hypothesis, the query run, and a TP/FP/INCONCLUSIVE/GAP verdict grounded in observed evidence (with the missing signal named for INCONCLUSIVE/GAP).
Not done if: a verdict was asserted without a runnable query; an ambiguous result was forced to TP; hunt diagnosed the cause or scored severity (out of scope); no drawer/receipt was written.
Next step: TP → analyze (find the cause) and/or adversary (score severity); FP → close it; GAP →
the missing signal becomes the work (build the test/observability first).
Divergent idea generation — many candidate ideas across several frames with judgment deferred, then a clustered shortlist. Use to open a solution space wide, or /brainstorm. Not for developing one idea (ideate) or picking one (propose).
Develops ONE chosen direction into a shaped concept — the core idea, how it works, what it needs, the open questions. Use to deepen a single idea, or /ideate. Not for generating many (brainstorm) or deciding among them (propose).
Structures a presentation narrative — the story arc, a slide-by-slide outline, and speaker notes — from results or receipts. Use to shape a talk or deck, or /present. Not for prose reports (report) or rendering visuals (asset).
Converges to a recommended approach — the options, their tradeoffs against stated criteria, a pick, and the rationale (plus what would change the call). Use to decide among approaches, or /propose. Not for generating options (brainstorm) or deep-diving one (ideate).
Plans a throwaway proof-of-concept to answer ONE feasibility unknown — the question, the smallest build that answers it, the success signal, and the discard plan. Use to de-risk before committing, or /prototype. Not for the real build (executor) or deciding (propose).
Produces a REDTEAM-FINDINGS.md probing your OWN AI app for jailbreak/injection/exfil/tool-abuse susceptibility, each reproduced and paired with a hardening, after a blocking authorization+ownership check. Use to red-team an owned AI system defensively.