Agentic Bug Hunter is a terminal toolkit that uses AI to investigate security targets, test for vulnerabilities, validate findings, and write bug bounty reports. It is for ethical hackers submitting findings to platforms such as HackerOne, Bugcrowd, Intigriti, or Immunefi, and can resume previous sessions. The catalogue entries package commands, skills, agents, instructions, hooks, and settings for using the toolkit.
Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Awarexone/Agentic-Bug-Hunternpx agentmods add skills/awarexone/agentic-bug-hunter/meme-coin-auditWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/awarexone/agentic-bug-hunter/meme-coin-audit)<a href="https://agentmods.dev/skills/awarexone/agentic-bug-hunter/meme-coin-audit"><img src="https://agentmods.dev/badge/skills/awarexone/agentic-bug-hunter/meme-coin-audit.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00129 | $0.02604 |
| Opus 5 | $0.00064 | $0.01302 |
| Sonnet 5 | $0.00026 | $0.00521 |
| Haiku 4.5 | $0.00013 | $0.00260 |
Grade A, and why
meme-coin-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 295 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MEME COIN & TOKEN SECURITY AUDIT
Fast-kill rug pull detection and deep token security analysis for EVM and Solana meme coins.
PRE-DIVE KILL SIGNALS
Check these BEFORE reading a single line of code. If any are true, skip the audit — the token is likely a rug or not worth the time.
Hard Kills (Skip Immediately)
- Contract not verified on Etherscan/Solscan → Cannot audit source = cannot trust
- Deployer wallet has history of rug pulls (check Etherscan deployer page)
- Token age < 1 hour AND no known team → Too early, wait for more data
- Mint authority retained (Solana) AND no cap → Infinite mint = certain rug
- Freeze authority retained (Solana) on meme coin → Honeypot confirmed
- Transfer hook present (Token-2022) with mutable hook program → Honeypot vector
- Permanent delegate extension (Token-2022) → Can steal all holder tokens
Soft Kills (Proceed with Extreme Caution)
- Top holder > 20% of supply (excluding DEX pools)
- LP not burned or locked in verified contract
- Contract is upgradeable / proxy with retained admin
- Less than $5K liquidity in the pool
- No social presence / anonymous deployer with no history
THE ONE RULE
"Check ALL authorities and owner functions. The retained authority IS the rug vector."
Every rug pull requires a privileged operation: mint, blacklist, fee change, LP removal, or authority abuse. If you find the privilege, you found the bug.
BUG CLASSES (8 TOKEN-SPECIFIC)
1. HIDDEN MINT / UNLIMITED SUPPLY
35% of meme coin rugs. Deployer mints tokens post-launch, dumps on LP.
Quick grep (EVM):
grep -rn "function mint\|_mint(\|_balances\[.*\] +=" src/ --include="*.sol" | grep -v "test\|lib\|node_modules"
Quick grep (Solana):
grep -rn "MintTo\|mint_to\|mint_authority" src/ --include="*.rs" | grep -v "test\|target"
Kill if: MAX_SUPPLY enforced in every mint path, or mint function removed entirely.
2. HONEYPOT / TRANSFER RESTRICTION
25% of meme coin scams. Buy works, sell blocked.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 295 lines · 129 tokens per session scan A d98b7eb1da9f
meme-coin-audit is a skill published in the GitHub repository Awarexone/Agentic-Bug-Hunter (4,715 stars, last pushed 3d ago), licensed MIT. It adds 129 tokens to every session and 2,604 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
web3-auditor
Smart contract and Web3/DeFi security auditor. Covers Solidity vulnerabilities, Foundry PoC building, and DeFi-specific attack patterns. Use for Immunefi, Code4rena, and other Web3 bug bounty programs.
bugcrowd-reporting
Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints…
apk-redteam-pipeline
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external…
enterprise-vpn-attack
External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials…
evidence-hygiene
Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails, phones, faces — vs what is safe to leave — usernames, trace…
hunt-api-misconfig
Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {isadmin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this…