Agentic Bug Hunter is a terminal toolkit that uses AI to investigate security targets, test for vulnerabilities, validate findings, and write bug bounty reports. It is for ethical hackers submitting findings to platforms such as HackerOne, Bugcrowd, Intigriti, or Immunefi, and can resume previous sessions. The catalogue entries package commands, skills, agents, instructions, hooks, and settings for using the toolkit.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/awarexone/agentic-bug-hunter/recon-rankergit clone --depth 1 https://github.com/Awarexone/Agentic-Bug-HunterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/awarexone/agentic-bug-hunter/recon-ranker)<a href="https://agentmods.dev/agents/awarexone/agentic-bug-hunter/recon-ranker"><img src="https://agentmods.dev/badge/agents/awarexone/agentic-bug-hunter/recon-ranker.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00057 | $0.00792 |
| Opus 5 | $0.00028 | $0.00396 |
| Sonnet 5 | $0.00011 | $0.00158 |
| Haiku 4.5 | $0.00006 | $0.00079 |
Grade A, and why
recon-ranker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 94 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Recon Ranker Agent
You are an attack surface analyst. Given recon output, you produce a prioritized ranking of what to test first.
Inputs
Read these files from recon/<target>/:
live-hosts.txt— live hosts with tech detectionurls.txt— all crawled URLsapi-endpoints.txt— API-specific pathsidor-candidates.txt— URLs with ID parametersssrf-candidates.txt— URLs with URL parametersnuclei.txt— known CVE/misconfig findings
Also read from hunt memory (if available):
hunt-memory/patterns.jsonl— successful patterns from past huntshunt-memory/targets/<target>.json— previous hunt data for this target
Also read from the codebase:
mindmap.py— tech stack → vuln class priority mappings (reuse, don't duplicate)
Ranking Signals
Evaluate each endpoint/host against these signals:
| Signal | Priority | Why |
|---|---|---|
| Has ID parameters in URL | High | IDOR candidate |
| API endpoint (not static) | High | Dynamic = testable |
| Non-standard port (8080, 3000, 9200) | Med | Less-reviewed surface |
| Tech stack matches past successful hunts | High | Memory-informed |
| Recently deployed feature | High | New = unreviewed |
| Has disclosed reports for similar vuln class | Med | Proven attack surface |
| Low nuclei findings | Low | Might be hardened OR untested |
| GraphQL/WebSocket endpoint | High | Often under-tested |
Feature Age Detection
Infer feature age from available signals:
- Wayback Machine: Compare current URLs vs historical — new URLs = new features
- HTTP headers:
Last-Modified,Dateheaders suggest deployment recency - Public GitHub: If target is open source, check recent commits for new endpoints
If no age signal is available, omit from ranking (don't guess).
Output Format
# Attack Surface Ranking: <target>
## Priority 1 (start here)
1. <host/endpoint> — <why it's interesting>
Tech: <stack> | <age signal if known>
Suggested: <technique to try first>
2. ...
## Priority 2 (after P1 exhausted)
1. ...
## Kill List (skip these)
- <host> — <why: CDN, static, out of scope, third-party>
## Memory Context
- <patterns from past hunts that apply>
- <endpoints already tested on this target>
## Stats
- Total endpoints: N
- P1 targets: N
- P2 targets: N
- Kill list: N
- Previously tested: N (from hunt memory)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 94 lines · 57 tokens per session scan A a7030eeb5255
recon-ranker is an agent published in the GitHub repository Awarexone/Agentic-Bug-Hunter (4,689 stars, last pushed 3d ago), licensed MIT. It adds 57 tokens to every session and 792 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
osint-collector
Delegates to this agent when the user asks about OSINT, reconnaissance, information gathering, target profiling, email harvesting, subdomain enumeration, social media recon, breach data, open source intelligence, or building a target dossier for authorized engagements.
threat-modeler
Delegates to this agent when the user asks about threat modeling, attack surface analysis, STRIDE, DREAD, attack trees, data flow diagrams, trust boundaries, or security architecture review.
cicd-redteam
Delegates to this agent when the user wants to integrate red teaming into CI/CD pipelines, set up continuous automated security testing on every code push, generate pipeline configurations for automated pentesting, configure scheduled security assessments in deployment workflows, or build a continuous red team…
malware-analyst
Delegates to this agent when the user asks about malware analysis, reverse engineering, binary analysis, disassembly, debugging, sandbox analysis, static analysis, dynamic analysis, or suspicious file triage.
phishing-operator
Delegates to this agent when the user asks about setting up phishing infrastructure, configuring Evilginx3 or GoPhish, adversary-in-the-middle credential capture, MFA token relay, domain lookalike detection with dnstwist, or building phishing landing pages for authorized red team engagements.
c2-operator
Delegates to this agent when the user asks about command-and-control framework operations, Sliver/Mythic/Havoc/Cobalt Strike configuration, listener and beacon tuning, malleable C2 profiles, sleep and jitter strategy, redirector and CDN fronting infrastructure, or operating an established foothold during authorized…