bug-bounty From the maker
awarexone/Agentic-Bug-HunterSkill
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via co
Why this score
This repo hosts 10 skills, so its 5,379 stars are split between them (about 538 each) for scoring.
Popularity score: 77/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank
Security
Scanned Oct 20, 2026 at commit 40b03eeea639, first 300 source files (it's a large repo), with Cisco's open-source skill-scanner.
What its code does:
- Reads environment variables and sends network requests with them API clients do this to send your key to the service. Check which service it talks to.bughunter/brain.py, bughunter/tools/zendesk_idor_test.py, bughunter/tools/_spray_oauth.py:117 and 7 more
- Runs shell commands Common for dev tools. Read the commands it runs.README.md:3, SKILL.md:658, bughunter/tools/_auth_helper.sh:59 and 43 more
- Runs code it builds while running (eval or exec) Harder to read ahead of time, since the code is assembled while it runs.bughunter/brain.py:1866
- Makes network requestsSKILL.md, bughunter/brain.py:774, bughunter/engine.py:436 and 48 more
- Reads environment variables, where API keys usually livebughunter/brain.py:2079, bughunter/mcp/bughunter-mcp/adapters.py:117, bughunter/tools/hunt.py:473 and 4 more
- Installs system packagesbughunter/tools/_dep_hint.sh:38
- Uses dependencies without a pinned version A later version of a dependency could change what runs.pyproject.toml:23 and 2 more
A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan
Alternatives
Other makers' add-ons that do the same job, next to this one.
| Name | Score | Stars | Context | Updated |
|---|---|---|---|---|
| This onebug-bounty awarexone/Agentic-Bug-Hunter · Skill | 77 | ★ 5.4k | ≈153 always | 26d ago |
| api-fuzzing-bug-bounty zebbern/claude-code-guide · Skill Same job: backend & apis | 76 | ★ 4.7k | ≈69 always | 17d ago |
| bug-bounty-triage Sequester-AG/bug-bounty-triage · Skill Both about bounty and bug | 71 | ★ 139 | ≈97 always | 26d ago |
| bug-report Donchitos/Claude-Code-Game-Studios · Skill Both about bug | 85 | ★ 27k | ≈30 always | 17d ago |
| bug-analysis fishzjp/qa-skills · Skill Both about bug | 56 | ★ 49 | ≈52 always | 25d ago |
| running-bug-review-board RayFernando1337/rayfernando-skills · Skill Both about bug and hunt | 53 | ★ 129 | ≈23 always | 4mo ago |