Bugcrowd Reporting (Grade A)针对Claude AI的安全测试技能，已通过安全验证。A级。补充报告撰写的Bugcrowd特定报告策略：当不存在精确匹配时的VRT类别搜索与回退策略，

Why this exists?

Most Claude bug‑hunting setups are either too generic (one big "security" prompt) or too fragmented (bookmarking dozens of disclosed reports). Neither scales past the second target. This bundle was built and validated through authorized engagements that exposed capability gaps: bug‑bounty work revealed missing hypothesis discipline, lack of per‑program reporting tactics, disorganized engagement coordination, and poor evidence hygiene. External red‑team work added gaps such as conservative defaults that retracted real findings, no mid‑engagement situational awareness, and missing enterprise‑platform attack chains (e.g., M365/Entra, SharePoint, SSL‑VPN, vCenter, Android APKs). The bundle addresses these issues with structured methodology, red‑team mindset, up‑to‑date CVE knowledge, and integrated reporting tools.

Asked by Petra Vogel · Jul 22, 2026

How it works?

It follows a six‑phase, non‑linear workflow: recon → map & rank → hunt → validate → report, with scope enforced in code and a 7‑Question Gate before any submission. You can drive the process in two ways: by describing what you’re testing in plain English, which automatically loads the relevant skill set, or by using the /hunt scaffold and the cbh CLI, which provides an engagement‑folder structure, state management, and orchestration. Documentation includes a usage guide, a worked example, a diagram of the six‑phase architecture, and a skill‑to‑phase mapping.

Asked by Jana Krejčí · Jun 2, 2026

What's inside?

The bundle contains 82 skills, auto‑loaded by topic with no need to invoke them by name. Coverage spans the external attack surface: Web application hunting (13 skills, e.g., XSS, SQLi, SSRF, IDOR, LFI, SSTI, XXE, CSRF, CORS, open‑redirect), Authentication & identity (7 skills, e.g., auth‑bypass, session, OAuth, SAML, MFA‑bypass, ATO), API & infrastructure (15 skills, e.g., GraphQL, gRPC, WebSocket, API‑misconfig, host‑header, RCE), Advanced & concurrency (6 skills, e.g., race‑condition, HTTP smuggling, deserialization, cache‑poison), Framework‑specific (4 skills, e.g., Next.js, Node.js, Laravel, Spring Boot), Enterprise identity & cloud (3 skills, e.g., M365/Entra, Okta, cloud‑IAM), Infrastructure & appliance (4 skills, e.g., VMware vCenter, enterprise VPN, SharePoint, ASP.NET/NTLM), Red‑team tradecraft (4 skills, e.g., redteam‑mindset, APK pipeline, supply‑chain recon, mid‑engagement IR), Recon & OSINT (4 skills), and Workflow, reporting & specialized (11 skills). The catalog is searchable in docs/skills.md, and the bundle also ships 15 slash commands (/hunt, /recon, /report, …) and a deterministic engagement engine that maps a target’s attack surface and routes each finding to the appropriate skill.

Asked by Joanna Kowalski · May 17, 2026

What is this?

claude-bughunter is a drop-in skill bundle for the Claude Code skills system. Install once and Claude Code stops being a chatbot and starts behaving like a senior bug‑hunting researcher or red‑team operator: it knows the techniques, the chain templates, the VRT mappings, the platform CVE chains, and the hygiene — and it stays in scope. Four layers stack: Think — bb‑methodology + redteam‑mindset: the 5‑phase non‑linear workflow, critical‑thinking framework, and red‑team operator discipline. Hunt webapps — 48 hunt‑skills curated from 681 disclosed HackerOne reports: per‑class detection patterns, payloads, bypass tables, and chain templates. Hit the perimeter — enterprise platform chains (M365/Entra, Okta, vCenter, SSL‑VPN appliances, SharePoint, cloud IAM): current 2024–2026 CVE chains + post‑credential escalation. Ship it — triage‑validation + reporting + evidence‑hygiene: the 7‑Question Gate, VRT‑aware severity, OOS rebuttals, PII redaction, and red‑team deliverables. All triggered automatically by topic — describe what you're testing in plain English and the relevant skill loads.

Asked by Bruno Kaufmann · Apr 26, 2026