bug-bounty plugins

13 tagged bug-bounty, measured the same way as everything else here.

Browse within: cybersecurity 6

Claude-BugHunter

02

elementalsouls/Claude-BugHunter

Plugin Claude Code

Bundles 11 skills, 15 commands · 3,173 tokens together

83-skill bug-hunting & external red-team bundle for Claude Code — 58 hunt- web/vuln-class + framework skills, enterprise platform attack chains (M365/Entra, Okta, SharePoint, vCenter, SSL-VPN, APK/iOS), recon/OSINT, reporting & validation gates, and Burp MCP integration. Skills auto-load by topic; 15 slash commands in.

not rated 4.9k 6d ago A tokens not measured original MIT

Claude-BugHunter

04

Zyrexnn/Cybermes

Plugin Claude Code

Bundles 11 skills, 15 commands · 2,409 tokens together

82-skill bug-hunting & external red-team bundle for Claude Code — 57 hunt- web/vuln-class + framework skills, enterprise platform attack chains (M365/Entra, Okta, SharePoint, vCenter, SSL-VPN, APK/iOS), recon/OSINT, reporting & validation gates, and Burp MCP integration. Skills auto-load by topic; 15 slash commands in.

not rated 668 1mo ago A tokens not measured copy · 88% Apache-2.0

cybersec-toolkit

05

26zl/cybersec-toolkit

Plugin Claude Code

Bundles 197 skills, 2 hooks, 1 MCP server · 12,682 tokens together

872 on-demand security skills for CTF, pentest, bug bounty, DFIR, detection engineering, cloud, identity, and red/blue team work. Skills are plain Markdown and activate by task without permanently consuming context. Bundles vendored skills under mixed licenses (MIT, Apache-2.0, CC-BY-SA-4.0) — see per-source…

not rated 76 +7 changed today A tokens not measured original MIT

find-cve-agent

06

ByamB4/find-cve-agent

Plugin Claude Code

Bundles 21 skills, 7 commands, 5 agents · 1,048 tokens together

CVE hunting harness for open source security research. A 5-agent team that systematically finds, validates, and reports real vulnerabilities in open source packages.

not rated 57 +2 7mo ago A tokens not measured original Apache-2.0

pentest

07

humaidhahm/opencode-pentester

Plugin Claude Code

Bundles 1 skill, 12 agents · 464 tokens together

Full penetration testing framework - 69 attack categories across 16 domains covering OWASP, injection, authentication, cloud, and more.

not rated 55 +6 22d ago A tokens not measured

akira

09

kalpmodi/akira

Plugin Claude Code

Bundles 16 skills · 1,498 tokens together

The AI pentest co-pilot that actually finds bugs. Phase-chained, evidence-gated offensive security skills for bug bounty and authorized pentesting.

not rated 23 3mo ago A tokens not measured original MIT

outrider-recon

10

Ap6pack/outrider-recon

Plugin Claude Code

Bundles 11 skills · 614 tokens together

Claude-native, governed offensive-OSINT and external attack-surface platform for authorized security teams: multi-agent recon across web/API, identity, cloud, secrets, and people/breach intelligence, with deterministic scope, evidence, and approval controls, a governed agent-to-agent orchestrator, and human-reviewed…

not rated 15 changed 1mo ago A tokens not measured

shor

11

tr4m0ryp/shor

Plugin Claude Code

Bundles 1 skill · 0 tokens together

Shor — autonomous AI web pentester. Provides the /shor-setup slash-command: an interactive wizard that guides you from zero to a running scan (black-box or white-box, GCP deployment included).

not rated 13 +1 2mo ago A tokens not measured

DouglasRao/Claude-Pentest-Skills

Plugin Claude Code

Bundles 8 skills · 902 tokens together

Professional penetration testing skills for Claude Code — structured offensive workflows covering two independent tracks: (1) Web track: web-recon, web-exploitation, web-postexploitation, web-report; (2) AD track: ad-recon, ad-exploitation, ad-postexploitation, ad-report. All skills include automatic evidence capture.

not rated 12 6mo ago A tokens not measured original MIT

ip-rotator

13

Aladeen12541/claude-ip-rotator

Plugin Claude Code

Bundles 1 skill, 1 command · 211 tokens together

AWS API Gateway IP rotation for security testing. Single switch routes ALL HTTP/HTTPS traffic (nuclei, httpx, ffuf, curl, everything) through rotating AWS IPs to bypass WAF rate limits and IP blocks.

not rated 3 3mo ago A tokens not measured original MIT