Complete Claude Code setup for bug bounty hunting — 99 skills, 22 slash commands, 10 agents, hooks, and 4 vendored toolkits (shuvonsec, transilience, Decepticon, hexstrike-ai)
ArianHobson333/claude-bug-bounty-stack
Skill Claude CodeCodex
Systematic IDOR / BOLA hunting methodology. Use when testing any endpoint that accepts an ID, UUID, slug, filename, or reference to a user-owned object.
ArianHobson333/claude-bug-bounty-stack
Skill Claude CodeCodex
SQL injection hunting methodology across error-based, union, blind boolean, and time-based variants. Use when testing any input that might reach a database.
ArianHobson333/claude-bug-bounty-stack
Skill Claude CodeCodex
SSRF hunting methodology with OOB detection via interactsh, cloud metadata targets, and blind SSRF techniques. Use on any feature that accepts a URL, hostname, or external reference.
ArianHobson333/claude-bug-bounty-stack
Skill Claude CodeCodex
XSS hunting methodology — reflected, stored, and DOM — with context-aware payloads. Use when testing any input that could reach a browser.
ArianHobson333/claude-bug-bounty-stack
Skill Claude CodeCodex
OWASP Top 10 (2021) and API Top 10 (2023) quick reference with attack patterns, test ideas, and CWE mappings. Load when hunting, code-reviewing for security, or writing bug bounty reports.
ArianHobson333/claude-bug-bounty-stack
Skill Claude CodeCodex
Bug bounty report generation — structure, triager-friendly writing, CVSS scoring, and chain reporting. Use when finalizing a finding for submission.
ArianHobson333/claude-bug-bounty-stack
Skill Claude CodeCodex
Curated index of external hacking resources — meta-lists, frameworks, wordlists, payload banks, recon/OSINT, network, exploitation, and CTF tooling. Load when the user asks "what's the tool for X", "where do I find payloads for Y", "is there a wordlist for Z", or when planning which external resource to pull for a…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: