Agentic Bug Hunter is a terminal toolkit that uses AI to investigate security targets, test for vulnerabilities, validate findings, and write bug bounty reports. It is for ethical hackers submitting findings to platforms such as HackerOne, Bugcrowd, Intigriti, or Immunefi, and can resume previous sessions. The catalogue entries package commands, skills, agents, instructions, hooks, and settings for using the toolkit.
Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Awarexone/Agentic-Bug-Hunternpx agentmods add skills/awarexone/agentic-bug-hunter/graphql-auditWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/awarexone/agentic-bug-hunter/graphql-audit)<a href="https://agentmods.dev/skills/awarexone/agentic-bug-hunter/graphql-audit"><img src="https://agentmods.dev/badge/skills/awarexone/agentic-bug-hunter/graphql-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/awarexone/agentic-bug-hunter/graphql-audit"><img src="https://agentmods.dev/badge/skills/awarexone/agentic-bug-hunter/graphql-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 8 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 68 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 77 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 125 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 166 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 178 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 198 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 245 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 363 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00092 | $0.04459 |
| Opus 5.5 | $0.00037 | $0.01784 |
| Sonnet 5.5 | $0.00018 | $0.00892 |
| Haiku 4.5 | $0.00009 | $0.00446 |
Grade A, and why
graphql-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -X POST https://target.com/graphql \ How it starts
The opening of the file, as written. The whole thing — 524 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GRAPHQL SECURITY AUDIT
GraphQL flips the threat model — clients drive queries. One endpoint, infinite attack surface. Introspection hands you the schema; even without it, field suggestions give you 80% back.
0. QUICK KILL CHECKLIST
[ ] Run graphql_audit.sh <endpoint> — full automated sweep
[ ] Check if introspection is enabled (__schema query)
[ ] If introspection off — run clairvoyance for field discovery
[ ] Fingerprint engine (graphw00f) — different engines, different CVEs
[ ] Test query batching — send 100 identical queries in one POST
[ ] Test alias bombing — 1000 aliases in one query
[ ] Check field suggestions on typos — leaks schema even when introspection off
[ ] Try IDOR: query another user's object by ID, no auth check
[ ] Test field-level auth: query privileged fields (admin, role, internalNote)
[ ] Inject SQLi/NoSQLi via string arguments — id, filter, search args
[ ] Check subscriptions: can you subscribe to other users' events?
[ ] Try introspection bypass: __schema\nquery, query batching, fragment tricks
[ ] Look for mutation rate limiting — account takeover / self-XSS via mutations
1. TOOL — graphql_audit.sh
# Basic audit
bash tools/graphql_audit.sh https://target.com/graphql
# With auth cookie
bash tools/graphql_audit.sh https://target.com/api/graphql --cookie "session=abc123"
# With Authorization header
bash tools/graphql_audit.sh https://target.com/graphql --header "Authorization: Bearer TOKEN"
# Through Burp proxy
bash tools/graphql_audit.sh https://target.com/graphql --proxy http://127.0.0.1:8080
# Custom output directory
bash tools/graphql_audit.sh https://target.com/graphql --output-dir ./findings/target/graphql
Output: findings/<target>/graphql/<timestamp>/
introspection.json— full schema dump (if enabled)fingerprint.txt— engine type (graphw00f)field_suggestions.txt— discovered fields via clairvoyancebatching_dos.txt— response time delta for 1 vs 100 queriesalias_bomb.txt— alias depth test resultsgqlmap.txt— injection scan resultscop_report.txt— graphql-cop attack checklist resultssummary.txt— hit/miss per phase
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 524 lines · 92 tokens per session scan A 1a5c554be934
graphql-audit is a skill published in the GitHub repository Awarexone/Agentic-Bug-Hunter (5,367 stars, last pushed 12d ago), licensed MIT. It adds 92 tokens to every session and 4,459 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
hunt-api-misconfig
Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {isadmin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this…
graphql-audit
GraphQL API security specialist. Use for introspection analysis, query complexity attacks, injection testing, authorization bypass, and batching abuse on GraphQL endpoints.
oauth-hunter
OAuth 2.0 / 2.1, OpenID Connect (OIDC), SAML SSO, and JWT specialist. Dispatcher passes subtype — 'oauth', 'oidc', 'saml', or 'jwt' — in the task; falls back to inference. Use for redirecturi / returnTo flaws, state/nonce/PKCE bypass, alg confusion (none/HS-with-RS-key/kid/jku), SAML XSW + comment injection +…
idor-hunter
IDOR / BOLA specialist (H1 #55, OWASP API1:2023). Use for testing insecure direct object references and broken object level authorization across web apps, APIs, GraphQL endpoints, multi-tenant SaaS, mobile, automotive/IoT, and AI inference servers.
file-upload
File Upload vulnerability specialist (H1 #39). Use for testing upload restrictions, content-type bypass, extension filtering, path traversal in filenames, and web shell upload scenarios.
race-condition
Race Condition specialist (H1 #29). Use for testing TOCTOU flaws, double-spend, parallel request abuse on balance operations, coupon redemption, and any non-idempotent state changes.