0xGhostCAT/claude-ai-cyber-security-skills
30 Claude Code Skills + 60+ integrated tools for HackerOne/Bugcrowd bug bounty hunters
ARCHETYPE
Skill Collector
Ten-plus skills loaded on demand. A procedural-knowledge library.
Copy this rig
# review before running: this installs third-party code
$ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills ./rig-claude-ai-cyber-security-skills/skills MCP servers are added to Claude Code at local scope; env vars are shown as YOUR_… placeholders — we never store values. Files are fetched with degit into a separate folder so you can review before merging.
$ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/01-program-selection .claude/skills/01-program-selection $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/02-scope-analysis .claude/skills/02-scope-analysis $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/03-threat-modeling-mindmap .claude/skills/03-threat-modeling-mindmap $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/04-subdomain-enum .claude/skills/04-subdomain-enum $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/05-asset-discovery .claude/skills/05-asset-discovery $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/06-fingerprinting .claude/skills/06-fingerprinting $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/07-js-analysis .claude/skills/07-js-analysis $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/08-content-discovery .claude/skills/08-content-discovery $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/09-continuous-monitoring .claude/skills/09-continuous-monitoring $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/10-idor-hunting .claude/skills/10-idor-hunting $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/11-auth-bypass .claude/skills/11-auth-bypass $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/12-ato-chains .claude/skills/12-ato-chains $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/13-xss .claude/skills/13-xss $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/14-sqli .claude/skills/14-sqli $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/15-ssrf .claude/skills/15-ssrf $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/16-ssti .claude/skills/16-ssti $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/17-file-upload .claude/skills/17-file-upload $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/18-graphql .claude/skills/18-graphql $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/19-jwt-attacks .claude/skills/19-jwt-attacks $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/20-oauth-oidc .claude/skills/20-oauth-oidc $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/21-business-logic .claude/skills/21-business-logic $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/22-subdomain-takeover .claude/skills/22-subdomain-takeover $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/23-cache-poisoning .claude/skills/23-cache-poisoning $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/24-http-smuggling .claude/skills/24-http-smuggling $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/25-llm-ai-security .claude/skills/25-llm-ai-security $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/26-mobile-recon-android .claude/skills/26-mobile-recon-android $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/27-cloud-misconfig .claude/skills/27-cloud-misconfig $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/28-triage-validation .claude/skills/28-triage-validation $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/29-hackerone-reporting .claude/skills/29-hackerone-reporting $ npx degit 0xGhostCAT/claude-ai-cyber-security-skills/skills/30-bugcrowd-reporting .claude/skills/30-bugcrowd-reporting
This rig commits no guardrails. Here is the community baseline instead — the deny/ask rules most often found across all 7,204 rigs:
{
"permissions": {
"deny": [
"Read(./.env)",
"Read(**/.env)",
"Read(~/.ssh/**)",
"Bash(rm -rf *)",
"Read(**/*.pem)",
"Bash(rm -rf /)",
"Bash(git push --force:*)",
"Bash(sudo *)",
"Read(.env)",
"Bash(rm -rf /*)",
"Read(./.env.*)",
"Read(~/.aws/**)",
"Bash(git push --force*)",
"Bash(rm -rf:*)",
"Read(**/*.key)",
"Read(**/.env.*)",
"Bash(sudo:*)",
"Bash(git reset --hard*)",
"Bash(git reset --hard:*)",
"Read(.env.*)"
],
"ask": [
"Bash(git push:*)",
"Bash(git push *)",
"Bash(git commit:*)",
"Bash(rm *)",
"Bash(rm:*)",
"Bash(git rebase *)",
"Bash(wget *)",
"Bash(npm publish:*)",
"Bash(git commit *)",
"Bash(gh pr merge *)"
]
}
} Skills (30)
program-selectionscope-analysisthreat-modeling-mindmapsubdomain-enumasset-discoveryfingerprintingjs-analysiscontent-discoverycontinuous-monitoringidor-huntingauth-bypassato-chainsxsssqlissrfsstifile-uploadgraphqljwt-attacksoauth-oidcbusiness-logicsubdomain-takeovercache-poisoninghttp-smugglingllm-ai-securitymobile-recon-androidcloud-misconfigtriage-validationhackerone-reportingbugcrowd-reporting
Similar rigs
Gabson0x/bountyforge
all round pentest skill
Skill Collector 1.3k tok ·
awarexone/Agentic-Bug-Hunter
AI-powered bug bounty hunting toolkit that works with or without subscription.
Skill Collector 5.5k tok ·
elementalsouls/Claude-BugHunter
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.
Skill Collector 6.7k tok ·
H-mmer/pentest-agents
Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops, exploit chain builder.
Orchestrator 73.0k tok ·