elementalsouls/Claude-BugHunter
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.
ARCHETYPE
Skill Collector
Ten-plus skills loaded on demand. A procedural-knowledge library.
Copy this rig
# review before running: this installs third-party code $ npx degit elementalsouls/Claude-BugHunter/commands ./rig-claude-bughunter/commands $ npx degit elementalsouls/Claude-BugHunter/skills ./rig-claude-bughunter/skills
MCP servers are added to Claude Code at local scope; env vars are shown as YOUR_… placeholders — we never store values. Files are fetched with degit into a separate folder so you can review before merging.
$ npx degit elementalsouls/Claude-BugHunter/skills/apk-redteam-pipeline .claude/skills/apk-redteam-pipeline $ npx degit elementalsouls/Claude-BugHunter/skills/bb-local-toolkit .claude/skills/bb-local-toolkit $ npx degit elementalsouls/Claude-BugHunter/skills/bb-methodology .claude/skills/bb-methodology $ npx degit elementalsouls/Claude-BugHunter/skills/bug-bounty .claude/skills/bug-bounty $ npx degit elementalsouls/Claude-BugHunter/skills/bugcrowd-reporting .claude/skills/bugcrowd-reporting $ npx degit elementalsouls/Claude-BugHunter/skills/cloud-iam-deep .claude/skills/cloud-iam-deep $ npx degit elementalsouls/Claude-BugHunter/skills/enterprise-vpn-attack .claude/skills/enterprise-vpn-attack $ npx degit elementalsouls/Claude-BugHunter/skills/evidence-hygiene .claude/skills/evidence-hygiene $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-api-misconfig .claude/skills/hunt-api-misconfig $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-aspnet .claude/skills/hunt-aspnet $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-ato .claude/skills/hunt-ato $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-auth-bypass .claude/skills/hunt-auth-bypass $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-brute-force .claude/skills/hunt-brute-force $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-business-logic .claude/skills/hunt-business-logic $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-cache-poison .claude/skills/hunt-cache-poison $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-captcha-bypass .claude/skills/hunt-captcha-bypass $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-cicd .claude/skills/hunt-cicd $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-clickjacking .claude/skills/hunt-clickjacking $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-cloud-misconfig .claude/skills/hunt-cloud-misconfig $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-cors .claude/skills/hunt-cors $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-csrf .claude/skills/hunt-csrf $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-deserialization .claude/skills/hunt-deserialization $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-dispatch .claude/skills/hunt-dispatch $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-dom .claude/skills/hunt-dom $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-exceptional-conditions .claude/skills/hunt-exceptional-conditions $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-file-upload .claude/skills/hunt-file-upload $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-fintech-graphql .claude/skills/hunt-fintech-graphql $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-forgot-<redacted> $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-graphql .claude/skills/hunt-graphql $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-grpc .claude/skills/hunt-grpc $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-host-header .claude/skills/hunt-host-header $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-html-injection .claude/skills/hunt-html-injection $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-http-smuggling .claude/skills/hunt-http-smuggling $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-idor .claude/skills/hunt-idor $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-jwt-crypto .claude/skills/hunt-jwt-crypto $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-k8s .claude/skills/hunt-k8s $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-laravel .claude/skills/hunt-laravel $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-ldap .claude/skills/hunt-ldap $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-lfi .claude/skills/hunt-lfi $ npx degit elementalsouls/Claude-BugHunter/skills/hunt-llm-ai .claude/skills/hunt-llm-ai
This rig commits no guardrails. Here is the community baseline instead — the deny/ask rules most often found across all 7,204 rigs:
{
"permissions": {
"deny": [
"Read(./.env)",
"Read(**/.env)",
"Read(~/.ssh/**)",
"Bash(rm -rf *)",
"Read(**/*.pem)",
"Bash(rm -rf /)",
"Bash(git push --force:*)",
"Bash(sudo *)",
"Read(.env)",
"Bash(rm -rf /*)",
"Read(./.env.*)",
"Read(~/.aws/**)",
"Bash(git push --force*)",
"Bash(rm -rf:*)",
"Read(**/*.key)",
"Read(**/.env.*)",
"Bash(sudo:*)",
"Bash(git reset --hard*)",
"Bash(git reset --hard:*)",
"Read(.env.*)"
],
"ask": [
"Bash(git push:*)",
"Bash(git push *)",
"Bash(git commit:*)",
"Bash(rm *)",
"Bash(rm:*)",
"Bash(git rebase *)",
"Bash(wget *)",
"Bash(npm publish:*)",
"Bash(git commit *)",
"Bash(gh pr merge *)"
]
}
} Skills (83)
apk-redteam-pipelinebb-local-toolkitbb-methodologybug-bountybugcrowd-reportingcloud-iam-deepenterprise-vpn-attackevidence-hygienehunt-api-misconfighunt-aspnethunt-atohunt-auth-bypasshunt-brute-forcehunt-business-logichunt-cache-poisonhunt-captcha-bypasshunt-cicdhunt-clickjackinghunt-cloud-misconfighunt-corshunt-csrfhunt-deserializationhunt-dispatchhunt-domhunt-exceptional-conditionshunt-file-uploadhunt-fintech-graphqlhunt-forgot-passwordhunt-graphqlhunt-grpchunt-host-headerhunt-html-injectionhunt-http-smugglinghunt-idorhunt-jwt-cryptohunt-k8shunt-laravelhunt-ldaphunt-lfihunt-llm-aihunt-mfa-bypasshunt-mischunt-nextjshunt-nodejshunt-nosqlihunt-ntlm-infohunt-oauthhunt-open-redirecthunt-race-conditionhunt-rag-vectorhunt-rcehunt-samlhunt-sessionhunt-shadow-apihunt-sharepointhunt-source-leakhunt-spa-apihunt-springboothunt-sqlihunt-ssrfhunt-sstihunt-subdomainhunt-tls-networkhunt-websockethunt-xsshunt-xxeios-redteam-pipelinem365-entra-attackmeme-coin-auditmid-engagement-ir-detectionoffensive-osintokta-attackosint-methodologyrecon-scope-triageredteam-mindsetredteam-report-templatereport-writingsecurity-arsenalsupply-chain-attack-recontriage-validationvmware-vcenter-attackweb2-reconweb3-audit
Slash commands (15)
/autopilot/chain/hunt/intel/memory-gc/pickup/recon/remember/report/scope/surface/token-scan/triage/validate/web3-audit
Similar rigs
Gabson0x/bountyforge
all round pentest skill
Skill Collector 1.3k tok ·
awarexone/Agentic-Bug-Hunter
AI-powered bug bounty hunting toolkit that works with or without subscription.
Skill Collector 5.5k tok ·
ArianHobson333/claude-bug-bounty-stack
Complete Claude Code setup for bug bounty hunting — 99 skills, 22 slash commands, 10 agents, hooks, and 4 vendored toolkits (shuvonsec, transilience, Decepticon, hexstrike-ai)
Pragmatist 1.1k tok ·
elementalsouls/Claude-OSINT
8 Claude skills · 100+ recon capabilities · 80 secret-regex patterns · 80+ dorks · 9 read-only credential validators · 27 attack-path templates · ~10,000 lines of structured tradecraft. Drop-in SKILL.md files that turn Claude into a god-mod
Skill Collector 872 tok ·