← All skills
offensive-osint
50 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53
Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog (AWS/GCP/GitHub/Stripe/Slack/Anthropic/…
Works with any agent that supports SKILL.md skills.
What this skill can do
Changes files outside its own folder
The author does not mention this.
Found in 2 places.
Sends data to these websites: cavalier.hudsonrock.com, app.target.com, login.microsoftonline.com, teams.microsoft.com, ${stem}${sub}.sharepoint.com, ${stem}${s}.sharepoint.com, ${stem}-my.sharepoint.com, app.target.example
The author does not mention this. Expected for a security skill.
Found in 142 places.
Show 17 more
- skills/offensive-osint/references/breach-and-credentials.md, line 30
$hr = Invoke-RestMethod -Uri "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=$D" -TimeoutSec 30 - skills/offensive-osint/references/identity-fabric.md, line 172
curl -sk -m 10 "https://login.microsoftonline.com/${TARGET_DOMAIN}/.well-known/openid-configuration" | jq -r '.issuer' - skills/offensive-osint/references/identity-fabric.md, line 174
curl -sk -m 10 "https://teams.microsoft.com/api/mt/emea/beta/users/<email>/externalsearchv3" - skills/offensive-osint/references/identity-fabric.md, line 182
curl -sk -m 10 -I "https://${STEM}${sub}.sharepoint.com/" -w '%{http_code}\n' - skills/offensive-osint/references/identity-fabric.md, line 197
$r = Invoke-WebRequest -Uri "https://${STEM}${s}.sharepoint.com/" -Method Head -UseBasicParsing -TimeoutSec 10 - skills/offensive-osint/references/identity-fabric.md, line 210
curl -sk -m 10 -I "https://${STEM}-my.sharepoint.com/personal/${USER_TOKEN}/Documents/" -w '%{http_code}\n' - skills/offensive-osint/references/identity-fabric.md, line 216
curl -sk -m 10 "https://app.target.example/main.js" | \ - skills/offensive-osint/references/identity-fabric.md, line 222
curl -sk -m 10 "https://login.microsoftonline.com/${TARGET_DOMAIN}/v2.0/.well-known/openid-configuration" | \ - skills/offensive-osint/references/identity-fabric.md, line 244
curl -sk -m 10 -X POST "$T/graphql" \ - skills/offensive-osint/references/identity-fabric.md, line 252
curl -sk -m 10 -X POST "$T/graphql" \ - skills/offensive-osint/references/probes-and-wordlists.md, line 372
curl -sk -m 10 "$T/.git/config" | grep -E '\[core\]|\[remote|repositoryformatversion' - skills/offensive-osint/references/probes-and-wordlists.md, line 375
curl -sk -m 10 "$T/.git/HEAD" | grep -E '^ref:' - skills/offensive-osint/references/probes-and-wordlists.md, line 378
curl -sk -m 10 "$T/.env" | grep -E '^[[:space:]]*[A-Z_][A-Z0-9_]*[[:space:]]*=' - skills/offensive-osint/references/probes-and-wordlists.md, line 381
curl -sk -m 10 "$T/server-status" | grep -i 'Apache Server Status' - skills/offensive-osint/references/probes-and-wordlists.md, line 384
curl -sk -m 10 "$T/server-info" | grep -i 'Apache Server Information' - skills/offensive-osint/references/probes-and-wordlists.md, line 387
curl -sk -m 10 "$T/.DS_Store" -o /tmp/dsstore && file /tmp/dsstore | grep -i 'data' - skills/offensive-osint/references/probes-and-wordlists.md, line 390
curl -sk -m 10 "$T/phpinfo.php" | grep -E 'phpinfo\(\)|PHP Version'
and 122 more places
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 2 places.
Downloads and installs other software
The author does not mention this.
Found in 41 places.
Show 17 more
- skills/offensive-osint/references/recon-stack.md, line 183
pip install sslyze - skills/offensive-osint/references/tooling-install.md, line 13
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest - skills/offensive-osint/references/tooling-install.md, line 16
go install github.com/owasp-amass/amass/v4/...@master - skills/offensive-osint/references/tooling-install.md, line 19
go install github.com/tomnomnom/assetfinder@latest - skills/offensive-osint/references/tooling-install.md, line 22
go install github.com/projectdiscovery/dnsx/cmd/dnsx@latest - skills/offensive-osint/references/tooling-install.md, line 25
go install github.com/d3mondev/puredns/v2@latest - skills/offensive-osint/references/tooling-install.md, line 32
go install github.com/projectdiscovery/httpx/cmd/httpx@latest - skills/offensive-osint/references/tooling-install.md, line 35
go install github.com/sensepost/gowitness@latest - skills/offensive-osint/references/tooling-install.md, line 38
go install github.com/michenriksen/aquatone@latest - skills/offensive-osint/references/tooling-install.md, line 45
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest - skills/offensive-osint/references/tooling-install.md, line 49
go install github.com/projectdiscovery/naabu/v2/cmd/naabu@latest - skills/offensive-osint/references/tooling-install.md, line 59
go install github.com/ffuf/ffuf/v2@latest - skills/offensive-osint/references/tooling-install.md, line 62
go install github.com/OJ/gobuster/v3@latest - skills/offensive-osint/references/tooling-install.md, line 65
cargo install feroxbuster - skills/offensive-osint/references/tooling-install.md, line 72
go install github.com/projectdiscovery/katana/cmd/katana@latest - skills/offensive-osint/references/tooling-install.md, line 75
go install github.com/jaeles-project/gospider@latest - skills/offensive-osint/references/tooling-install.md, line 78
git clone https://github.com/GerbenJavado/LinkFinder && cd LinkFinder && pip install -r requirements.txt
and 21 more places
Can call paid AI services billed to you
This is disclosed by the author in the skill's SKILL.md or README.
Found in 10 places.
Show 7 more
Runs commands on your computer
The author does not mention this. Expected for a security skill.
Found in 3 places.
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'offensive-osint' ] || [ -L ~/.agents/skills/'offensive-osint' ]; then echo 'A skill folder named offensive-osint already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/offensive-osint' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/offensive-osint' ~/.agents/skills/'offensive-osint' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'offensive-osint' ~/.claude/skills/'offensive-osint' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)
Score history
| Date | Version | Score |
|---|
| 2026-11-10 | d5dcc53 | 50 |
| 2026-11-08 | 42a3ab1 | 50 |
| 2026-11-06 | 3e71af0 | 50 |