104 tagged bug bounty, measured the same way as everything else here.
Browse within: ai-security 61bugcrowd 52claude-ai 37cti 37automated-testing 19ethical-hacking 19kali-linux 19llm-agent 19cybersecurity 18application-security 15appsec 15bugbounty 15devsecops 15exploit-validation 15
Command
Probe a 403/401 endpoint with the most-paid bypass tricks (header injection, path encoding, method swap, WAF fingerprint, vendor-specific). Wraps byp4xx when installed; otherwise runs a built-in matrix of 38+ techniques. Usage: /bypass-403 | /bypass-403 -l.
Command
Password spray with hard guards — typed-hostname confirmation, lockout warning, audit log. Modes: http-form (custom login page), oauth (password grant), o365 + okta (via TREVORspray). Default delay 30min/round + 60s jitter. Usage /spray --mode --users --passes.
Command
Smart contract security audit — runs through 10 bug class checklist (accounting desync, access control, incomplete path, off-by-one, oracle errors, ERC4626, reentrancy, flash loan, signature replay, proxy/upgrade). Applies pre-dive kill signals first. Generates Foundry PoC template for confirmed findings. Usage…
elementalsouls/Claude-BugHunter
Command
Active vulnerability hunting. Two-track dispatcher — asks Red Team vs WAPT, hands off to hunt-dispatch skill and sibling commands. Usage: /hunt target.com | /hunt .target.com | /hunt targets.txt [--vuln-class X] [--source-code P] [--chrome].
elementalsouls/Claude-BugHunter
Command
Run full recon pipeline on a target — subdomain enum (Chaos API + subfinder), live host discovery (dnsx + httpx), URL crawl (katana + waybackurls + gau), gf pattern classification, nuclei scan. Outputs to recon/ / directory. Usage: /recon target.com.
elementalsouls/Claude-BugHunter
Command
Meme coin and token security scan — checks for rug pull vectors (hidden mint, honeypot, fee manipulation, LP lock bypass, authority retention, bonding curve exploits, fake renounce, sandwich amplification). Manual 8-class grep audit (with an optional automated scanner if present). Usage: /token-scan [--chain solana].
Command
List pentest-ai agents relevant to a domain or tag (web, ad, cloud, mobile, recon, etc.).
Command
Update the project memory with what was accomplished in this session.
Command
Recommend the right pentest-ai agent and concrete next steps for a freeform task description.
Command
Command "recon" from Zyrexnn/Cybermes, covering /recon, what this does, usage, steps and step 1: subdomain enumeration.
Command
Command "report" from Zyrexnn/Cybermes, covering /report, pre-conditions, usage, what this generates and platform selection.
Command
Command "web3-audit" from Zyrexnn/Cybermes, covering /web3-audit, usage, step 0: pre-dive kill signals, find accounting variables and find all early returns in critical functions.
Command
You are the operator managing authentication credentials for the current engagement. The user's arguments specify the auth type and value.
Command
You are the operator resuming a previously interrupted engagement. The engagement directory and state files (scope.json, log.md, findings.md, cases.db) contain all the context needed to continue without repeating work.
Command
You are the operator providing a status summary of the current engagement.
Command Claude Code
Route an attack vector to the appropriate specialist agent — usage: /project:attack.
Command Claude Code
Start a new engagement for a target — verifies scope, creates evidence directories, and launches recon agent.
Command Claude Code
Incident response workflow — triage, evidence collection, timeline, and IOC extraction.
Command
Run the 6-gate false positive elimination process on the current finding. Usage: /fp-check (run from a target directory with findings).
Command
Find targets in a category. Usage: /recon . Examples: /recon csv-parsers, /recon template-engines, /recon archive-libs.
Command
Generate a disclosure report from the current finding. Auto-detects the best submission channel. Usage: /report (run from target directory with confirmed finding).
Copenhagen0x/solana-security-standard
Command
Scan a path against the Solana Security Standard (SOL-0XX) and report findings with fixes.
Aladeen12541/claude-ip-rotator
Command
Single switch for AWS API Gateway IP rotation. 'on' starts gateway + MITM proxy, routes ALL tools (nuclei, httpx, ffuf, curl) through rotating AWS IPs. 'off' stops everything. Usage: /ip-rotator on target.com | /ip-rotator off | /ip-rotator status. Triggers: "use ip rotator", "rotate ip", "bypass waf", "unblock ip"…