Bug Bounty (Grade F)Security-tested testing-security skill for Claude AI. Grade F. Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hu

How it works?

The tool follows a 6‑phase, non‑linear workflow: recon → map & rank → hunt → validate → report, with scope enforced in code and a 7‑Question Gate before any finding is submitted. There are two ways to drive the workflow: 1. **Plain English** – Describe what you’re testing, and the relevant skill loads are automatically applied. 2. **/hunt scaffold + cbh CLI** – Provides an engagement‑folder structure, state management, and orchestration. Documentation includes a usage guide, a worked example, a 6‑phase architecture diagram, and a skill‑to‑phase mapping, plus the cbh command‑line interface.

Asked by Linda Petersen · Nov 16, 2025

What's inside?

The bundle contains 82 skills, auto‑loaded by topic with no need for explicit invocation. Coverage spans the external attack surface, including: - Web application hunting (13 skills: XSS, SQLi, SSRF, IDOR, LFI, SSTI, XXE, CSRF, CORS, open‑redirect, etc.) - Authentication & identity (7 skills: auth‑bypass, session, OAuth, SAML, MFA‑bypass, ATO) - API & infrastructure (15 skills: GraphQL, gRPC, WebSocket, API‑misconfig, host‑header, RCE) - Advanced & concurrency (6 skills: race‑condition, HTTP smuggling, deserialization, cache‑poison) - Framework‑specific (4 skills: Next.js, Node.js, Laravel, Spring Boot) - Enterprise identity & cloud (3 skills: M365/Entra, Okta, cloud‑IAM‑deep) - Infrastructure & appliance (4 skills: VMware vCenter, enterprise VPN, SharePoint, ASP.NET/NTLM) - Red‑team tradecraft (4 skills: redteam‑mindset, APK pipeline, supply‑chain recon, mid‑engagement IR) - Recon & OSINT (4 skills: web2‑recon, offensive‑osint, subdomain) - Workflow, reporting & specialized (11 skills: methodology, triage‑validation, evidence‑hygiene, VRT‑aware reporting) A full searchable catalog is available in docs/skills.md. The bundle also ships 15 slash commands (e.g., /hunt, /recon, /report) and a deterministic engagement engine that maps a target’s attack surface and routes each finding to the appropriate skill.

Asked by Lucas Petit · Nov 12, 2025

What is this?

claude-bughunter is a drop-in skill bundle for the Claude Code skills system. Install once and Claude Code stops being a chatbot and starts behaving like a senior bug‑hunting researcher or red‑team operator: it knows the techniques, the chain templates, the VRT mappings, the platform CVE chains, and the hygiene — and it stays in scope. Four layers stack: Think — bb‑methodology + redteam‑mindset: the 5‑phase non‑linear workflow, critical‑thinking framework, and red‑team operator discipline. Hunt webapps — 48 hunt‑skills curated from 681 disclosed HackerOne reports: per‑class detection patterns, payloads, bypass tables, and chain templates. Hit the perimeter — enterprise platform chains (M365/Entra, Okta, vCenter, SSL‑VPN appliances, SharePoint, cloud IAM): current 2024–2026 CVE chains + post‑credential escalation. Ship it — triage‑validation + reporting + evidence‑hygiene: the 7‑Question Gate, VRT‑aware severity, OOS rebuttals, PII redaction, and red‑team deliverables. All triggered automatically by topic — describe what you're testing in plain English and the relevant skill loads. No invocation by name.

Asked by Mohammed Al-Amin · Oct 29, 2025