Awarexone

Awarexone/Agentic-Bug-Hunter

Hook Claude Code

Runs when the agent finishes a response, executing memory_gc.py with --rotate. From Awarexone/Agentic-Bug-Hunter.

Awarexone/Agentic-Bug-Hunter

Settings file Claude Code

Agent settings declaring 1 hook event (Stop).

Awarexone/Agentic-Bug-Hunter

Instructions file CodexOpenCode

AGENTS.md instructions for Awarexone/Agentic-Bug-Hunter, covering bug bounty agent toolkit — plugin guide, what's here, commands (slash commands), agents (9 specialized agents) and rules (always active).

Awarexone/Agentic-Bug-Hunter

Instructions file

Claude Code instructions for Awarexone/Agentic-Bug-Hunter, covering claude bug bounty — plugin guide, what's here, commands (33 slash commands), agents (9 specialized agents) and rules (always active).

Awarexone/Agentic-Bug-Hunter

Skill Claude CodeCodex

Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload…

Awarexone/Agentic-Bug-Hunter

Agent

Autonomous hunt loop agent. Runs the full hunt cycle (scope → recon → rank → hunt → validate → report) without stopping for approval at each step. Configurable checkpoints (--paranoid, --normal, --yolo). Uses scopechecker.py for deterministic scope safety on every outbound request. Logs all requests to audit.jsonl.…

Awarexone/Agentic-Bug-Hunter

Agent

Exploit chain builder. Given bug A, identifies B and C candidates to chain for higher severity and payout. Knows all major chain patterns — IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth, prompt injection→IDOR, subdomain takeover→OAuth redirect. Use when you have a…

Awarexone/Agentic-Bug-Hunter

Agent

Autonomous credential-attack pipeline runner. Chains /wordlist-gen + /osint-employees + /breach-check (data-prep stages, runs without prompts) then HARD STOPS before /spray (live attack stage requires human go/no-go). Designed so the user only types the target once instead of orchestrating four separate commands.…

Awarexone/Agentic-Bug-Hunter

Agent

Subdomain enumeration and live host discovery specialist. Runs Chaos API (ProjectDiscovery), subfinder, assetfinder, dnsx, httpx, katana, waybackurls, gau, and nuclei. Produces prioritized attack surface for a target. Use when starting recon on a new target domain.

Awarexone/Agentic-Bug-Hunter

Agent

Attack surface ranking agent. Takes recon output and hunt memory, produces a prioritized attack plan. Ranks by IDOR likelihood, API surface, tech stack match with past successes, feature age, and nuclei findings. Use after recon to decide what to test first.

Awarexone/Agentic-Bug-Hunter

Agent

Bug bounty report writer. Generates professional H1/Bugcrowd/Intigriti/Immunefi reports. Impact-first writing, human tone, no theoretical language, CVSS 4.0 calculation included. Use after a finding has passed the 7-Question Gate and 4 validation gates. Never generates reports with "could potentially" language.

Awarexone/Agentic-Bug-Hunter

Agent

Fast meme coin and token security auditor. Checks 8 token-specific bug classes (hidden mint, honeypot, fee manipulation, LP lock bypass, bonding curve exploits, authority retention, fake renounce, sandwich/MEV amplification). Runs tokenscanner.py for automated red flag detection. Covers EVM (Solidity) and Solana…

Awarexone/Agentic-Bug-Hunter

Agent

Finding validator. Runs the 7-Question Gate and 4-gate checklist on a described finding. Kills weak/theoretical findings fast before report writing. Prevents N/A submissions. Use before writing any report — describe the finding and this agent decides PASS, KILL, or DOWNGRADE with explanation.

Awarexone/Agentic-Bug-Hunter

Agent

Smart contract security auditor. Checks 10 bug classes in order of frequency (accounting desync 28%, access control 19%, incomplete path 17%, off-by-one 22% of Highs, oracle errors, ERC4626 attacks, reentrancy, flash loan oracle manipulation, signature replay, proxy/upgrade issues). Applies pre-dive kill signals…

Awarexone/Agentic-Bug-Hunter

Command

Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from high-signal repos. Use to bootstrap a fresh box or audit which optional capabilities are wired in. Usage: /arsenal | /arsenal.

Awarexone/Agentic-Bug-Hunter

Command

Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo].

Awarexone/Agentic-Bug-Hunter

Command

HIBP k-anonymity check on a password wordlist. Enriches each password with its breach count, ranks DESC. Free API (no key), only first 5 chars of SHA-1 sent. Output -> -ranked.txt. Usage /breach-check [--min-count N] [--max-count N] [--with-counts].

Awarexone/Agentic-Bug-Hunter

Command

Probe a 403/401 endpoint with the most-paid bypass tricks (header injection, path encoding, method swap, WAF fingerprint, vendor-specific). Wraps byp4xx when installed; otherwise runs a built-in matrix of 38+ techniques. Usage: /bypass-403 | /bypass-403 -l.

Awarexone/Agentic-Bug-Hunter

Command

Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain.

Awarexone/Agentic-Bug-Hunter

Command

Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloudenum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in DNS-history fallback). Use --keyword for storage discovery and --cf-bypass to find an origin IP behind CloudFlare. Usage: /cloud-recon --keyword | /cloud-recon…

Awarexone/Agentic-Bug-Hunter

Command

Scan an endpoint for CORS misconfiguration — arbitrary-origin reflection, null-origin trust, credential exposure, suffix/prefix regex bypass, scheme downgrade. Usage: /cors [--cookie "session=..."] | /cors -l urls.txt.

Awarexone/Agentic-Bug-Hunter

Command

Test for CRLF / HTTP response-splitting and host-header injection — Set-Cookie injection, cache poisoning, reset-poisoning. Usage: /crlf [--host-header] | /crlf -l urls.txt.

Awarexone/Agentic-Bug-Hunter

Command

Confirm DOM XSS in a real headless browser — injects canary payloads into params + URL fragment and only reports when the browser actually executes them. Usage: /domxss " " [--params q,name] [--shot out.png].

Awarexone/Agentic-Bug-Hunter

Command

Active vulnerability hunt against a target by invoking tools/hunt.py (which calls vulnscanner.sh against recon/ /). Auto-runs recon first if no recon dir exists. Usage: /hunt target.com.