ASK191225

ASK191225/bugbounty-kit

Settings file Claude Code

Agent settings declaring 2 hook events (pretoolcall, posttoolcall).

ASK191225/bugbounty-kit

MCP server Claude CodeCodexCursor +2

MCP server "hackerone" as configured in ASK191225/bugbounty-kit. Runs C:\Users\ask92\Downloads\bugbounty-kit\scripts\hackerone_mcp.py with python. Needs 2 environment variables to run.

ASK191225/bugbounty-kit

MCP server Claude CodeCodexCursor +2

Gives the agent read and write access to a set of allowed directories on the local filesystem. Runs locally from the @modelcontextprotocol/server-filesystem npm package.

ASK191225/bugbounty-kit

MCP server Claude CodeCodexCursor +2

MCP server "fetch" as configured in ASK191225/bugbounty-kit. Runs locally from the @modelcontextprotocol/server-fetch npm package.

ASK191225/bugbounty-kit

MCP server Claude CodeCodexCursor +2

MCP server "git" as configured in ASK191225/bugbounty-kit. Runs locally from the @modelcontextprotocol/server-git npm package. Needs 1 environment variable to run.

ASK191225/bugbounty-kit

MCP server Claude CodeCodexCursor +2

Lets the agent search the web and local businesses through the Brave Search API. Runs locally from the @modelcontextprotocol/server-brave-search npm package. Needs 1 environment variable to run.

ASK191225/bugbounty-kit

Instructions file

Claude Code instructions for ASK191225/bugbounty-kit, covering recon-ai // bug bounty research agent — sota edition, identity & operating mode, full autonomy pipeline (mandatory — no shortcuts), session startup checklist and slash commands (installed globally in /.claude/).

ASK191225/bugbounty-kit

Agent

Autonomous hunt loop agent. Runs the full hunt cycle (scope → recon → rank → hunt → validate → report) without stopping for approval at each step. Configurable checkpoints (--paranoid, --normal, --yolo). Uses scopechecker.py for deterministic scope safety on every outbound request. Logs all requests to audit.jsonl.…

ASK191225/bugbounty-kit

Agent

Exploit chain builder. Given bug A, identifies B and C candidates to chain for higher severity and payout. Knows all major chain patterns — IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth, prompt injection→IDOR, subdomain takeover→OAuth redirect. Use when you have a…

ASK191225/bugbounty-kit

Agent

Autonomous credential-attack pipeline runner. Chains /wordlist-gen + /osint-employees + /breach-check (data-prep stages, runs without prompts) then HARD STOPS before /spray (live attack stage requires human go/no-go). Designed so the user only types the target once instead of orchestrating four separate commands.…

ASK191225/bugbounty-kit

Agent

Subdomain enumeration and live host discovery specialist. Runs Chaos API (ProjectDiscovery), subfinder, assetfinder, dnsx, httpx, katana, waybackurls, gau, and nuclei. Produces prioritized attack surface for a target. Use when starting recon on a new target domain.

ASK191225/bugbounty-kit

Agent

Attack surface ranking agent. Takes recon output and hunt memory, produces a prioritized attack plan. Ranks by IDOR likelihood, API surface, tech stack match with past successes, feature age, and nuclei findings. Use after recon to decide what to test first.

ASK191225/bugbounty-kit

Agent

Bug bounty report writer. Generates professional H1/Bugcrowd/Intigriti/Immunefi reports. Impact-first writing, human tone, no theoretical language, CVSS 4.0 calculation included. Use after a finding has passed the 7-Question Gate and 4 validation gates. Never generates reports with "could potentially" language.

ASK191225/bugbounty-kit

Agent

Fast meme coin and token security auditor. Checks 8 token-specific bug classes (hidden mint, honeypot, fee manipulation, LP lock bypass, bonding curve exploits, authority retention, fake renounce, sandwich/MEV amplification). Runs tokenscanner.py for automated red flag detection. Covers EVM (Solidity) and Solana…

ASK191225/bugbounty-kit

Agent

Finding validator. Runs the 7-Question Gate and 4-gate checklist on a described finding. Kills weak/theoretical findings fast before report writing. Prevents N/A submissions. Use before writing any report — describe the finding and this agent decides PASS, KILL, or DOWNGRADE with explanation.

ASK191225/bugbounty-kit

Agent

Smart contract security auditor. Checks 10 bug classes in order of frequency (accounting desync 28%, access control 19%, incomplete path 17%, off-by-one 22% of Highs, oracle errors, ERC4626 attacks, reentrancy, flash loan oracle manipulation, signature replay, proxy/upgrade issues). Applies pre-dive kill signals…

ASK191225/bugbounty-kit

Skill Claude CodeCodex

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct…

ASK191225/bugbounty-kit

Skill Claude CodeCodex

Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.

ASK191225/bugbounty-kit

Skill Claude CodeCodex

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "codeql analysis", "build codeql database", or "find vulnerabilities with codeql". Supports "run all" (security-and-quality + security-experimental suites) and…

ASK191225/bugbounty-kit

Skill Claude CodeCodex

Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.

ASK191225/bugbounty-kit

Skill Claude CodeCodex

Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security…

ASK191225/bugbounty-kit

Skill Claude CodeCodex

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

ASK191225/bugbounty-kit

Skill Claude CodeCodex

Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT…

ASK191225/bugbounty-kit

Skill Claude CodeCodex

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.