Verify the connection
Call auth_status. Return the authentication status, account plan,
remaining credits, and enabled modules. Do not call other tools.
Domain inventory
For example.com, call fullhunt_domain_details and
fullhunt_domain_subdomains. Return:
1. The root-domain fields reported by FullHunt
2. Discovered subdomains
3. Hosts with externally visible services
4. The timestamp or freshness fields present in each response
Separate API observations from your interpretation.
Host and technology review
Call fullhunt_host for api.example.com. List observed IP addresses,
ports, services, TLS names, detected products, and collection timestamps.
Do not describe the lookup as a live scan.
Vulnerability prioritization
Use search_vulnerabilities, search_exploits, and search_advisories for
CVE-2024-3094. Report CVSS, EPSS, CISA KEV status, affected products,
known exploit records, and source identifiers. Mark fields that are absent.
Do not infer that an asset is affected from a product name alone.
Supply-chain advisory search
Call search_advisories with ecosystem="npm" and package="npm/lodash".
Return advisory identifiers, aliases, affected version ranges, fixed versions,
and source links. Deduplicate aliases that refer to the same advisory.
SOC IP enrichment
For 192.0.2.10, call nexus_ip_lookup, nexus_tor_check_ip, and
intel_ip_to_hosts. Return a JSON object with ip_context, tor_observation,
associated_hosts, evidence_timestamps, and analyst_notes. Do not emit a
binary malicious verdict unless a returned field directly supports it.
Attack-surface drift
For a domain in my authorized scope, retrieve current domain and host data.
If OEM access is available, also call oem_historical_hosts_search and
oem_alerts_search. Compare the supplied previous baseline with current data.
Classify additions, removals, and changed ports, products, or certificates.
Do not initiate a scan.
Brand impersonation triage
Use enterprise_darkweb_potential_phishing and
enterprise_darkweb_typosquatting with q="example.com". For newly observed
candidates, retrieve available WHOIS and certificate context. Rank the review
queue by first-seen date and evidence, not by an invented risk score.
OEM scan and status
Replace the target variable only with an asset you own or are explicitly authorized to test.
After I confirm the authorized target, call oem_on_demand_scan once.
Return the scan_id without polling. Then call oem_scan_status only when I ask,
and stop when status is scan_completed or failed.
OEM tenant usage reconciliation
Call oem_account_credits and oem_account_audit_logs for 2026-08-01 through
2026-08-31. Group audit entries by query_tags.tenant_id and service. Return
request counts, credited operations, failed operations, and remaining credits.
Do not include API keys or raw credential values in the output.
Search and fetch research
Call search with query="CVE-2024-3094". Show the returned result stubs.
Select the vulnerability result, call fetch with its exact id, and cite only
fields present in the fetched FullHunt response.
Prompt anti-patterns
| Avoid | Use instead |
|---|---|
| ”Tell me everything about this company” | Name the organization, permitted tools, fields, and stopping condition |
| ”Is this IP malicious?” | Request Tor, passive DNS, reverse-host, and returned reputation evidence separately |
| ”Monitor this domain forever” | Define one retrieval run; implement scheduling and state outside the model |
| ”Generate a security score” | Request transparent metrics and explain each observed input |
| ”Scan this company” | Confirm ownership or written authorization and name the exact target |