agentmods.dev

web3-hunt-foundation

web3-hunt-foundation is a skill for Claude Code, Codex from Awarexone/web3-bug-bounty-hunting-ai-skills. It costs 42 tokens per session (2,512 once invoked), scanned A, original, MIT.

A starting guide for Web3 bug-bounty reviews, where researchers look for security flaws in blockchain applications in exchange for possible rewards. It covers choosing targets, understanding their architecture, and checking whether a suspected issue could produce a real gain.

In plain words
What is it for?
Use it at the beginning of a smart-contract or protocol hunt. It helps score targets, prepare the review environment, and validate possible attacks before writing code.
Why use it?
It keeps reviews focused on specific attacker actions and measurable outcomes instead of vague suspicions. It also provides questions for checking setup requirements, costs, detection, and whether an attack is actually profitable.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

not rated 143repo +3 18d ago A scan SkillSpector: pass 42 tokens original MIT

Good fit Use it at the beginning of a smart-contract or protocol hunt. It helps score targets, prepare the review environment, and validate possible attacks before writing code.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/awarexone/web3-bug-bounty-hunting-ai-skills/web3-hunt-foundation
View source ↗ Awarexone/web3-bug-bounty-hunting-ai-skills awarexone.com
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add Awarexone/web3-bug-bounty-hunting-ai-skills --skill web3-hunt-foundation
Clone the repo
git clone --depth 1 https://github.com/Awarexone/web3-bug-bounty-hunting-ai-skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for web3-hunt-foundation

README.md
[![agentmods](https://agentmods.dev/badge/skills/awarexone/web3-bug-bounty-hunting-ai-skills/web3-hunt-foundation/github.svg)](https://agentmods.dev/skills/awarexone/web3-bug-bounty-hunting-ai-skills/web3-hunt-foundation)
Your own site
<a href="https://agentmods.dev/skills/awarexone/web3-bug-bounty-hunting-ai-skills/web3-hunt-foundation"><img src="https://agentmods.dev/badge/skills/awarexone/web3-bug-bounty-hunting-ai-skills/web3-hunt-foundation/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for web3-hunt-foundation

Your own site · 80×15
<a href="https://agentmods.dev/skills/awarexone/web3-bug-bounty-hunting-ai-skills/web3-hunt-foundation"><img src="https://agentmods.dev/badge/skills/awarexone/web3-bug-bounty-hunting-ai-skills/web3-hunt-foundation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 42 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,512 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00042 $0.02512
Opus 5 $0.00021 $0.01256
Sonnet 5 $0.00008 $0.00502
Haiku 4.5 $0.00004 $0.00251

Measured 13d ago against content hash c37b59108722, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

web3-hunt-foundation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

web3-hunt-foundation/SKILL.md · 284 lines

How it starts

The opening of the file, as written. The whole thing — 284 lines — stays where its author put it; the contents beside it link to each section on GitHub.

WEB3 HUNT FOUNDATION

Mindset + Recon + Setup. Read this before touching any new target's code. Replaces: 01-mindset, 02-recon-setup, 20-chain-complete

PART 1: THE HUNTER MINDSET

The Core Mental Shift

You are NOT looking for "vulnerabilities" in the abstract. You are looking for specific actions an attacker can take TODAY that result in profit.

Everything flows from one question: "What can I STEAL, FREEZE, or DESTROY — and what do I END UP WITH?"

The Bug Validation Template

Apply to every finding before writing a single line:

I am an attacker. I will:
1. SETUP:   What do I need? (wallet, capital, any whitelisted permissions?)
2. CALL:    Exact transactions, exact order, exact function names
3. RESULT:  What do I end up with that I didn't start with?
4. COST:    Gas + capital + flash loan fee + any other expense
5. DETECT:  Can anyone stop or reverse this?
6. NET ROI: I gained X at cost of Y. Is Y << X?

If you can't fill in steps 2 and 3 with specific function calls → it's not a real bug. Stop. Move on.

10 Attacker Questions (Ask For Every External Function)

  1. What if amount = 0? Does anything revert or silently pass?
  2. What if I call this function twice in the same block?
  3. What if I call this before initialize() is called?
  4. What if I front-run this transaction?
  5. What if the external call fails? Does state get half-updated?
  6. What if the token has fee-on-transfer? Does amount received ≠ amount sent?
  7. What if I pass address(0) or a malicious contract as an address param?
  8. What if I pass type(uint256).max as a numeric param?
  9. Can I combine this with a flash loan? (zero-cost capital changes the math)
  10. Does a sibling function lack the same modifier this function has?

Question #10 explains 19% of all Critical findings. If vote() has onlyRole(VOTER), check poke(), reset(), harvest() — the missing modifier on the sibling IS the bug.

6 Triager Counter-Questions (Disprove Your Own Finding)

Read the full file on GitHub · 284 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 13d ago First seen · 284 lines · 42 tokens per session scan A c37b59108722

Subscribe to this mod's changes

web3-hunt-foundation is a skill published in the GitHub repository Awarexone/web3-bug-bounty-hunting-ai-skills (143 stars, last pushed 18d ago), licensed MIT. It adds 42 tokens to every session and 2,512 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Claude CodeSecurityWeb3 and blockchainblockchain-securitybug-bountydefiethereumfoundry
Related

Other skills, from other repositories

analyzing-ethereum-smart-contract-vulnerabilities

Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to Ethereum mainnet.

xalgorix/xalgorix · 49 tokens

propfund

Trade on PropFund, the decentralized on-chain prop firm for AI agents. Two layers: PropFund SCREENS you (a free evaluation, then a virtual "funded" probation leg that builds an immutable on-chain record — pool-as-counterparty, no real firm capital), and AgentDesk PAYS you (once your record clears the bar you graduate…

NO7r34L/PropFund.eth · 0 tokens

token-antiflash

When this skill is triggered, DO NOT directly implement all strategies. Follow this workflow.

0xlayerghost/solidity-agent-kit · 91 tokens

solidity-coding

When a contract involves state initialization (external addresses, business parameters, role assignments), DO NOT default to any single approach. Follow this workflow.

0xlayerghost/solidity-agent-kit · 66 tokens

solidity-checklist

Most on-chain operation failures come from skipping systematic verification. Instead of the reactive loop.

0xlayerghost/solidity-agent-kit · 68 tokens

programmable-v4-hook-builder

Build, repair, validate, submit, or track a complete Programmable Uniswap v4 Custom launch through the public V3 API. Use when the user names Programmable and wants implementation or launch work for a hook, token, multi-contract graph, app, game, service, or hybrid. Do not use for explanation-only questions, unrelated…

programmablehq/PROGRAMMABLE · 90 tokens