Proactive threat hunt over web/application logs — no alert in hand. Profiles the corpus, runs a hypothesis-driven hunt loop with a mandatory written ledger, confirms suspects in source, detonates a local PoC, and writes INCIDENTS.json + INCIDENT_REPORT.md. Use when asked to "hunt the logs", "find the campaign", "look for signs of compromise", or "run dnr-hunt".
Install
npx skills add anthropics/defending-code-reference-harness --skill dnr-huntnpx skills add anthropics/defending-code-reference-harness --skill dnr-hunt -a claude-code -gnpx skills add anthropics/defending-code-reference-harness --skill dnr-hunt -a codex -ggemini skills install https://github.com/anthropics/defending-code-reference-harness.git --path .claude/skills/dnr-huntgh skill install anthropics/defending-code-reference-harness dnr-huntgit clone --depth 1 https://github.com/anthropics/defending-code-reference-harness /tmp/anthropics__defending-code-reference-harness
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/anthropics__defending-code-reference-harness/.claude/skills/dnr-hunt ~/.claude/skills/dnr-hunt # Claude Code
cp -R /tmp/anthropics__defending-code-reference-harness/.claude/skills/dnr-hunt ~/.agents/skills/dnr-hunt # Codex, Cursor, Gemini CLI, Copilot, OpenCode