Claude-BugHunter - A Claude Code skill bundle for bug hunting and ext

项目说明

!claude-bughunter banner

claude-bughunter

> A self-contained Claude skill bundle for bug hunting and external red-team work · 83 skills · 15 slash commands · 681 disclosed-report patterns (433 now indi cited & auditable) across 24 core classes · enterprise identity + infrastructure attack matrices · engagement-folder scaffolding · Burp MCP integration · battle-tested across authorized red-team and bug-hunting engagements, plus public training platforms (DVWA, OWASP Juice Shop, Hacker101, testphp..com).

Built by Sachin Sharma — Bug Hunting & GenAI Security Research.

<p align="center">
_{SPONSORED BY}
<br/>
<a href="
<picture>
<source media="(prefers-color-scheme: dark)" srcset="assets/sponsors/atlas-cloud-dark.svg">
<img alt="Atlas Cloud" src="assets/sponsors/atlas-cloud-light.svg" height="36">
</picture>
</a>
&nbsp;&nbsp;&nbsp;&nbsp;
<a href="
<picture>
<source media="(prefers-color-scheme: dark)" srcset="assets/sponsors/tw360-dark.svg">
<img alt="ThreatWatch360" src="assets/sponsors/tw360-light.svg" height="30">
</picture>
</a>
</p>

---

What is this?

claude-bughunter is a drop-in skill bundle for the Claude Code skills system. Install once and Claude Code stops being a chatbot and starts behaving like a senior bug-hunting researcher or red-team operator: it knows the techniques, the chain templates, the , the platform C, and the hygiene — and it stays in scope.

Four layers stack:

All triggered automatically by topic — describe what you're testing in plain English and the relevant skill loads. No in by name.

---

Quickstart

Option A — install as a Claude Code plugin (recommended). From inside Claude Code:

All 83 skills + 15 commands load namespaced under claude-bughunter: and update when you bump the plugin — no files copied into ~/.claude/.

Option B — copy install (no plugin system / pin to a clone):

Both copy the skills + commands into ~/.claude/ (macOS/Linux) or %USERPROFILE%\.claude\ (Windows) and wire the hunt engagement scaffolder.

What each install path gives you:

| Path | 83 skills + 15 slash commands | cbh CLI | hunt scaffolder |
|---|---|---|---|
| A — plugin | ✅ namespaced under claude-bughunter: | ➕ separate pipx install | ❌ clone-only |
| B — copy install | ✅ copied into ~/.claude/ | ✅ from the clone | ✅ from the clone |

The plugin is the fastest path to the skills + slash commands. The terminal-native
cbh runner installs standalone — pipx install git+
— so plugin users can add it without a full clone (see cbh CLI).
The hunt engagement scaffolder ships with the clone (Option B).

That's it. Open Claude Code and describe what you're testing in plain English — the right skill loads automatically, no in by name:

→ Full Installation guide · Usage guide · searchable skill catalog.

> The block above is an illustrati. To record a real demo of your own session: asciinema rec demo.cast → upload to asciinema.org and drop the badge here.

---

Runs on multiple agent harnesses

!One install, agent harnesses — Claude Code, OpenCode, Codex CLI, Hermes Agent, Google AntiGravity

The skills are plain Agent Skills — the same SKILL.md format that Claude Code · OpenCode · OpenAI Codex CLI · Hermes Agent · Google AntiGravity all load. One command installs them e:

| Harness | Target Skill Directory | Flag |
|---|---|---|
| Claude Code (baseline) | ~/.claude/skills/ | *(default)* |
| OpenCode | reads ~/.claude/skills/ & ~/.agents/skills/ | *(default)* / --agents |
| OpenAI Codex CLI | ~/.agents/skills/ | --agents |
| Hermes Agent | ~/.hermes/skills/ | --hermes |
| Google AntiGravity | ~/.gemini/config/skills/ | --antigravity |

--all (-All) detects installed harnesses and copies skills to each harness's path (~/.claude/skills, ~/.agents/skills, ~/.hermes/skills, ~/.gemini/config/skills); --burp-mcp (-BurpMcp) wires the Burp MCP server into each. The full *knowledge* layer ports to all five — the slash commands and /hunt engine stay Claude-Code-only by design.

→ Multi-harness guide

---

Star History

<a href="
<picture>
<source media="(prefers-color-scheme: dark)" srcset="assets/star-history-dark.svg" />
<source media="(prefers-color-scheme: light)" srcset="assets/star-history-light.svg" />
<img alt="Star history chart for Claude-BugHunter" src="assets/star-history-light.svg" width="840" />
</picture>
</a>

_{Chart is self-hosted — regenerate with python3 scripts/gen_star_history.py (needs gh auth login).
Refreshes automatically each day via .github/workflows/star-history.yml.}

---

Scope — what this bundle is for, and what it isn't

This bundle covers the external attack surface — anything reachable from the internet without first compromising an internal endpoint.

In scope

Out of scope (deliberate — not gaps, design decisions)

If you're running an internal red team that includes domain-takeo or lateral mo, this bundle won't help you in those phases — and we'd rather say that up front than have you find out mid-engagement. The external surface handoff to internal-RT tooling (Impacket, NetExec, CrackMapExec, Rubeus, Certify, BloodHound) is intentionally outside our scope. Co for internal AD and post-exploit may come in a future update.

---

What's inside

83 skills, auto-loaded by topic — no in by name. Co across the external attack surface:

| Category | # | Examples |
|---|---|---|
| Hunt — web app vuln classes | 58 | XSS, SQLi, SSRF, IDOR, LFI, SSTI, XXE, CSRF, CORS, open-redirect, SharePoint, ASP.NET/NTLM |
| Enterprise platform attack ★ | 10 | M365/Entra, Okta, cloud-IAM-deep, , enterprise VPN, APK/iOS red-team pipelines, supply-chain recon |
| Reporting & | 6 | triage-, e, report-writing, bugcrowd-reporting |
| Recon & OSINT | 5 | web2-recon, offensi, osint-methodology, recon-scope-triage |
| Methodology & mindset | 4 | bb-methodology, bug-bounty, redteam-mindset, bb-local-toolkit |

Full searchable catalog → docs/skills.md. Also ships 15 slash commands (/hunt, /recon, /report, …) and a deterministic engagement engine (engine/) that maps a target's attack surface and routes each finding to the skill that handles it.

---

How it works

A 6-phase, non-linear workflow — recon → map & rank → hunt → → report — with scope enforced in code and a 7-Question Gate before anything is submitted. Two ways to drive it:

→ Usage guide & worked example · 6-phase architecture & skill-to-phase map · cbh CLI

---

Authorization

These skills are intended for assets you own or have written authorization to assess (bug-bounty in-scope assets, pentest engagement letters, CTF challenges, your own infrastructure).

The skills include gates that auto-trigger when you point Claude at un third-party targets — triage-'s 7-Question Gate explicitly asks whether the asset is in scope (Q3) and on the program's accepted-impact list (Q2). The bugcrowd-reporting skill includes researcher-side hygiene (Bugcrowdninja alias, account-state restoration, friendly-tester posture) that signals legitimate authorized testing to the target's fraud team.

The bundle explicitly excludes: weaponizing 0-days against unauthorized targets, post-exploitation tooling, malware de, mass-targeting infrastructure. See SECURITY.md for the full posture.

> Heads-up — Anthropic runtime cyber safeguards. Anthropic's models apply real-time safeguards that block " exploitation or offensi tooling de" by default — so even *authorized, in-scope* work can hit a refusal that isn't this bundle's doing. If you do authorized offensi (pentest / bug bounty / red team), enroll in Anthropic's free, application-based Cyber Program (CVP) to get safeguards adjusted for legitimate dual-use work. (Mass data exfiltration and ransomware de stay prohibited and are *not* adjustable.) Details: Anthropic — real-time cyber safeguards.

Why your model switched mid-session

Separate from refusals, and easy to miss. On Opus 5, a narrow set of higher-risk cyber requests —
Anthropic names *exploit generation*, *binary-based scanning* and *penetration testing* —
fall back to Opus 4.8 rather than being refused. You get a notice and the response is labelled with
the model that answered, but in a long agentic run that is easy to scroll past, so it can look like
Opus 5 quietly got worse. See why Claude switched models.

What to do depends on what you are actually doing:

| Situation | What helps |
|---|---|
| Auditing your own code — re a repo you own for defects | Say so. "Defensi of my own repo", "check this against the OWASP Top 10", "secure refactor to remediate" describe the work accurately and read as remediation. This is not a workaround; the work genuinely is defensive. |
| Authorized offensive work — li, PoC for a bounty submission | This is what the bundle is for, and the supported route is CVP. Do not reword an offensi to look defensive to get past a classifier — enroll instead. |
| You just want the switching off | Settings → Capabilities disables automatic model switching. |

/hunt states the engagement frame (authorized, scope-bounded, remediable finding) on its first turn
for exactly this reason — engagement context belongs in the session explicitly, not implied.

---

Documentation

| Doc | Contents |
|---|---|
| README.md | This file — o, quickstart, scope, skill summary |
| INSTALL.md | Full setup with Burp MCP integration and optional skill regenerator |
| USAGE.md | Workflow walkthrough · decision tree · worked engagement example |
| docs/architecture.md | 6-phase architecture · skill-to-phase mapping · engagement composition |
| docs/cbh-cli.md | cbh CLI — nati orchestrating recon + classify + triage + report |
| docs/c.md | CISA KE snapshot — refreshed weekly via the workflow template at docs/automation/c.yml.template |
| docs/credits.md | Full attribution: 43 original skills + 8 from upstream |
| CONTRIBUTING.md | PR guidelines · skill quality standards · scope |
| SECURITY.md | Authorized-use posture · responsible disclosure · what's excluded |
| LICENSE | MIT |
| NOTICE | Upstream-skills attribution · no-redistribution note |
| LICENSE-CONTENT | CC BY 4.0 (skill methodology, wordlists, docs) |

---

Why this exists

Most bug-hunting Claude setups are either too generic (one big "security" prompt) or too fragmented (you bookmark 30 disclosed reports and re-read them every engagement). Neither scales past the second target.

This bundle was built and through authorized engagements that exposed different capability gaps:

Bug-bounty engagement — surfaced four gaps a starter 3-skill stack could not close:

1. No hypothesis discipline — drafts written before → wasted hours, hurt ratio
2. No per-program reporting tactics — auto-downgraded P3-worthy findings to P4
3. No engagement coordination — findings, e, and submission IDs scattered across folders
4. No e hygiene — screenshots leaked cookies and PII

External red-team engagement — exposed fi gaps that bug-bounty defaults made worse:

1. Conser defaults retracted real findings — WAPT mindset stopped tests early on defended targets where red-team continuation would ha bypass chains → redteam-mindset
2. No mid-engagement situational awareness — client SOC patched confirmed SQLi within 30 min; external attacker locked 14 accounts during a live test session — both in without explicit detection methodology → mid-engagement-ir-detection
3. No enterprise-platform attack chains — M365 + Entra ID, on-prem SharePoint, Cisco SSL VPN, , and 7 Android APKs all needed current 2024-2026 C and platform-specific tradecraft → m365-entra-attack, okta-attack, hunt-sharepoint, hunt-aspnet, hunt-ntlm-info, , enterprise-, apk-redteam-pipeline
4. No client-facing deli format — bug-bounty report templates don't fit enterprise red-team where output is a 50KB+ MD + DOCX with embedded screenshots → redteam-report-template
5. No post-credential escalation model — when recon yielded credentials (AWS keys, JWTs, GCP JSON), it was unclear what they granted or how to escalate → cloud-iam-deep

The per-class hunt-* skills address gap-zero (*"what should I look for in webapps"*) — the original 24 codifying patterns from 681 disclosed HackerOne reports, with 20+ framework/surface skills added by the community v3 expansion — Claude knows the actual chain templates real triagers paid for, not abstract OWASP Top 10. The enterprise-platform and red-team-tradecraft layers address what bug-bounty alone cannot: external red-team engagements against monitored enterprise targets.

---

Roadmap

---

Sponsors

<p align="center">
<a href="
<source media="(prefers-color-scheme: dark)" srcset="assets/sponsors/atlas-cloud-dark.svg">
<img alt="Atlas Cloud" src="assets/sponsors/atlas-cloud-light.svg" width="340">
</picture></a>
</p>

Atlas Cloud is a full-modal AI inference platform that gi a single AI API to access video generation, image generation, and LLM APIs. Instead of managing multiple integrations, you connect once and get unified access to 300+ curated models across all modalities.

Check out Atlas Cloud's new coding plan promotion for more budget-friendly API access: <

<p align="center">
<a href="
<source media="(prefers-color-scheme: dark)" srcset="assets/sponsors/tw360-dark.svg">
<img alt="ThreatWatch360" src="assets/sponsors/tw360-light.svg" width="430">
</picture></a>
</p>

ThreatWatch360 is an AI-powered offensi platform: continuous Attack Surface Management, AI-assisted penetration testing, brand protection, dark-web monitoring, and Cyber Threat Intelligence in one platform. findings with proof-of-concept and business-impact prioritization — signal o fatigue.

---

About

Operational tradecraft accumulated across bug-bounty engagements and authorized pentests, codified into Claude skills. Platform-agnostic — slot into any engagement workflow you already use, or none.

Author: ElementalSoul · GenAI Security Research

Sister project: Claude-OSINT — paired skills for the recon phase that this bundle picks up after. Its two recon skills (offensi, osint-methodology) are canonically maintained here and re-exported there, so the two are byte-identical. Installing both is safe: each bundle's installer (install.sh on macOS/Linux, install.ps1 on Windows) records a manifest, the script skips re-copying an identical skill, and --uninstall keeps any skill the other bundle still owns — uninstalling one ne the other.

foundation: shu/claude-bug-bounty — methodology, , reporting, payload library (8 of 83 skills + 15 slash commands)

Generator tool used (not ): shu/public-skills-builder — used to scaffold per-class skills from H1 disclosed reports

Inspirations:

Tool in:

License

This project is dual-licensed:

To be precise about the boundary: *.py, *.sh, and other source files are MIT; *.md documentation, wordlists, regex catalogs, and rubrics are CC BY 4.0.

Reuse the content freely — including commercially — as long as you credit Sachin Sharma / Claude-BugHunter and link back to this repository. See NOTICE for upstream-skills attribution.

---

> *"Gi the right skill and it stops being a chatbot. It becomes an operator."*

项目信息

开发语言：Python

Star 数：4775

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。