Borrowing it
Nothing to install: this file belongs to matty69v/Bug-Bounty-Agents. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/matty69v/Bug-Bounty-Agents/main/AGENTS.mdgit clone --depth 1 https://github.com/matty69v/Bug-Bounty-AgentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/matty69v/bug-bounty-agents/agents-md)<a href="https://agentmods.dev/instructions/matty69v/bug-bounty-agents/agents-md"><img src="https://agentmods.dev/badge/instructions/matty69v/bug-bounty-agents/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/matty69v/bug-bounty-agents/agents-md"><img src="https://agentmods.dev/badge/instructions/matty69v/bug-bounty-agents/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01166 | $0.01166 |
| Opus 5.5 | $0.00466 | $0.00466 |
| Sonnet 5.5 | $0.00233 | $0.00233 |
| Haiku 4.5 | $0.00117 | $0.00117 |
Grade A, and why
Bug-Bounty-Agents AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS Index
Machine-readable catalog of every agent in this repository. Used by
swarm-orchestrator and attack-planner to route tasks. Keep one row per
agent. Tags should be lowercase, hyphenated, and from the controlled
vocabulary below.
Controlled Vocabulary
Phase: recon, intel, web, api, infra, cloud, network, mobile, wireless, exploit, postex, defense, report, meta
MITRE ATT&CK Tactic (when applicable): reconnaissance, resource-development, initial-access, execution, persistence, privilege-escalation, defense-evasion, credential-access, discovery, lateral-movement, collection, command-and-control, exfiltration, impact
Risk Tier (operational impact if misused): safe (read-only/passive), active (touches target), intrusive (likely to alert/disrupt)
Index
| Agent | Phase | ATT&CK Tactic | Risk | Description |
|---|---|---|---|---|
recon-advisor |
recon | reconnaissance | safe | Surface enumeration and asset discovery |
osint-collector |
intel | reconnaissance | safe | Open-source intelligence gathering |
subdomain-takeover |
recon | reconnaissance | active | Dangling DNS and takeover validation |
threat-modeler |
meta | — | safe | STRIDE / attack-surface modeling |
engagement-planner |
meta | — | safe | Scope, RoE, test plan authoring |
attack-planner |
meta | — | safe | Multi-stage attack path planning |
web-hunter |
web | initial-access | active | Web application vulnerability hunting |
api-security |
api | initial-access | active | REST and GraphQL API testing |
graphql-hunter |
api | initial-access | active | GraphQL schema, authz, complexity |
bizlogic-hunter |
web | initial-access | active | Business logic flaws and abuse cases |
ssrf-hunter |
web | initial-access | active | SSRF discovery and filter bypass |
jwt-cracker |
web | credential-access | active | JWT/OIDC token attacks |
vuln-scanner |
recon | discovery | intrusive | Automated scanning orchestration |
cloud-security |
cloud | discovery | active | AWS/GCP/Azure misconfiguration hunting |
container-escape |
infra | privilege-escalation | intrusive | Docker/K8s breakout |
cicd-redteam |
infra | initial-access | intrusive | CI/CD and supply-chain attacks |
ad-attacker |
infra | lateral-movement | intrusive | Active Directory enum and abuse |
wireless-pentester |
wireless | initial-access | intrusive | Wi-Fi, Bluetooth, RF assessments |
mobile-pentester |
mobile | initial-access | active | iOS/Android application testing |
binary-exploit |
exploit | execution | intrusive | Memory corruption, ROP, pwn |
crypto-analyst |
exploit | credential-access | safe | Crypto primitive and protocol analysis |
hardware-hacker |
exploit | initial-access | intrusive | Embedded, JTAG, firmware extraction |
red-team-operator |
postex | command-and-control | intrusive | C2, OPSEC, long-haul operations |
purple-team |
defense | — | safe | Detection-as-you-attack collaboration |
exploit-chainer |
exploit | execution | active | Combine findings into chains |
exploit-guide |
exploit | execution | active | Step-by-step exploitation reference |
payload-crafter |
exploit | execution | active | Custom payload generation |
credential-tester |
exploit | credential-access | intrusive | Spraying, stuffing, brute force |
privesc-advisor |
postex | privilege-escalation | active | Linux/Windows privesc paths |
poc-validator |
exploit | — | active | Verify, stabilize, minimize PoCs |
llm-redteam |
exploit | initial-access | active | Prompt injection, RAG poisoning |
phishing-operator |
exploit | initial-access | intrusive | Phishing infra and campaigns |
social-engineer |
exploit | initial-access | intrusive | Pretexting, vishing |
malware-analyst |
defense | — | safe | Static and dynamic malware analysis |
reverse-engineer |
defense | — | safe | Binary RE, decompilation |
forensics-analyst |
defense | — | safe | DFIR, artifact analysis, timelines |
ctf-solver |
meta | — | safe | CTF challenge solver |
detection-engineer |
defense | — | safe | Detection and response engineering |
stig-analyst |
defense | — | safe | STIG/CIS compliance hardening |
report-generator |
report | — | safe | Triage-ready bug reports |
bug-bounty |
meta | — | active | General-purpose bounty assistant |
swarm-orchestrator |
meta | — | safe | Coordinate multiple agents |
_scope-guard |
meta | — | safe | Shared scope enforcement block |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 65 lines · 1,166 tokens per session scan A 5bcb44e64cf6
Bug-Bounty-Agents AGENTS.md is an instructions file published in the GitHub repository matty69v/Bug-Bounty-Agents (453 stars, last pushed 6mo ago), licensed MIT. It adds 1,166 tokens to every session, about $0.0047 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deno copilot-instructions.md
Copilot instructions for denoland/deno, covering deno development guide for github copilot, network access, high level overview, key directories and key files to understand first.