← All skills
bug-bounty
67 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a productivity skill usually connects to your mail, calendar or notes.
By iradoweck/antigravity-awesome-skills (GitHub) · productivity · 30 stars · scanned at commit 2984de1
Complete bug bounty workflow
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 13 places.
Show 10 more
- skills/bug-bounty/SKILL.md, line 220
| cloudenum | Cloud asset enumeration | `pip3 install cloud_enum` | - skills/bug-bounty/SKILL.md, line 221
| trufflehog | Secret scanning | `brew install trufflehog` | - skills/bug-bounty/SKILL.md, line 222
| gitleaks | Secret scanning | `brew install gitleaks` | - skills/bug-bounty/SKILL.md, line 223
| XSStrike | Advanced XSS scanner | `pip3 install xsstrike` | - skills/bug-bounty/SKILL.md, line 224
| SecretFinder | JS secret extraction | `pip3 install secretfinder` | - skills/bug-bounty/SKILL.md, line 225
| sqlmap | SQL injection | `pip3 install sqlmap` | - skills/bug-bounty/SKILL.md, line 226
| subzy | Subdomain takeover | `go install github.com/LukaSikic/subzy@latest` | - skills/bug-bounty/references/details.md, line 477
> **Tooling**: Use [sisakulint](https://sisaku-security.github.io/lint/) for automated SAST — 52 rules, taint propagation across steps/jobs/reusable workflows, - skills/bug-bounty/references/details.md, line 750
4. **Privileged consumption** — The cache is restored in a `push` or `schedule` workflow on the default branch. These workflows have full `secrets` access. The - skills/bug-bounty/references/details.md, line 763
4. **Lateral movement** — RoR persistence → wait for privileged `push`/`schedule` workflows → steal tokens from `.git/config`, `$GITHUB_ENV`, `/proc/PID/environ
Runs commands on your computer
The author does not mention this.
Found in 8 places.
Show 5 more
Sends data to these websites: ${target}-${suffix}.s3.amazonaws.com, hackerone.com, target, evil.com, attacker.burpcollaborator.net, $name.s3.amazonaws.com, target-app.firebaseio.com
This is disclosed by the author in the skill's SKILL.md or README. Expected for a productivity skill.
Found in 12 places.
Show 9 more
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (productivity) that look related. Check that one does what you need.
Other copies in this repository
iradoweck/antigravity-awesome-skills has 2 more folders with a skill named bug-bounty. This page shows the lowest-scoring copy.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'bug-bounty' ] || [ -L ~/.agents/skills/'bug-bounty' ]; then echo 'A skill folder named bug-bounty already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/iradoweck/antigravity-awesome-skills' "$d" && git -C "$d" checkout --quiet '2984de11956e413008c6f98121cd141c499e47a3' -- 'skills/bug-bounty' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/bug-bounty' ~/.agents/skills/'bug-bounty' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'bug-bounty' ~/.claude/skills/'bug-bounty' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for iradoweck/antigravity-awesome-skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/iradoweck/antigravity-awesome-skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | 2984de1 | 67 |
| 2026-11-06 | 2984de1 | 67 |