bountyforge
01Skill Claude CodeCodex
Bug bounty and security audit engine — trust-first iterative hunting. The "3rd eye" for pentesting.
not rated 455
+10
changed 1mo ago A 26 tokens
455Stars on the repository
30Mods indexed here, across every type
1mo agoLast push, which is what freshness is scored on
noneNo LICENSE: all rights reserved, so bodies are not copied
Skill Claude CodeCodex
The "3rd eye" for pentesting — reminds agent to understand before assuming, validate before reporting.
not rated 455
+10
changed 1mo ago A 25 tokens
bug-bounty
03Skill Claude CodeCodex
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload…
not rated 455
+10
changed 1mo ago F 371 tokens
code-sleuth
04Skill Claude CodeCodex
Analyze EVM smart contracts for storage-safety vulnerabilities that can cause persistent state updates to be lost, overwritten, misdirected, or to collide across proxy or upgrade boundaries.
not rated 455
+10
changed 1mo ago A 40 tokens
fizz
05Skill Claude CodeCodex
Generate Echidna/Medusa-compatible Solidity fuzz suites from Foundry or Hardhat projects. Trigger on "fizz", "generate fuzz suite", "build fuzz harness", "stateful fuzzing", "fuzzing harness", "property testing", and "invariant suite".
not rated 455
+10
changed 1mo ago A 60 tokens
fizz-convert
06Skill Claude CodeCodex
Convert English-language properties in PROPERTIES.md (produced by the Fizz skill) into Solidity assertions inside the existing fuzz harness, then flip their checkboxes. Trigger on "fizz-convert", "convert properties", "implement properties from PROPERTIES.md", "convert PROPERTIES.md to Solidity".
not rated 455
+10 1mo ago A 65 tokens
fizz-sync
07Skill Claude CodeCodex
Reconcile an existing Fizz harness with a changed source tree. Detects added/removed/changed contract functions, quarantines stale properties, regenerates drifted handler stubs, and refreshes the snapshot. Trigger on "fizz-sync", "resync fuzzing", "sync fuzz harness", "refresh fuzzing properties", "fuzzing drift…
not rated 455
+10 1mo ago A 77 tokens
godmod
08Skill Claude CodeCodex
Skill "godmod" from Gabson0x/bountyforge, covering godmod — expert mode, security researcher (pashov/myers level), pentester (oscp+ mindset), senior dev / architect and cracked generalist.
not rated 455
+10
changed 1mo ago A 0 tokens
Skill Codex
HackenProof bug bounty triage workflow for Claude Code plugin marketplace operations. Use when analyzing security reports, validating scope and exploitability, assigning severity, detecting duplicates, setting report state, adding labels/comments, and preparing consistent triage decisions for HackenProof programs.
not rated 455
+10
changed 1mo ago A 62 tokens
Skill Claude CodeCodex
Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP…
not rated 455
+10
changed 1mo ago A 129 tokens
Skill Claude CodeCodex
Security audit of Solidity code while you develop. Trigger on "audit", "check this contract", "review for security". Modes - default (full repo) or a specific filename.
not rated 455
+10
changed 1mo ago B 42 tokens
x-ray
12Skill Claude CodeCodex
Generates an x-ray.md pre-audit report covering overview, enhanced threat model (protocol-type profiling, git-weighted attack surfaces, temporal risk analysis, composability dependency mapping), invariants, integrations, docs quality, test analysis, and developer/git history. Triggers on 'x-ray', 'audit readiness'…
not rated 455
+10
changed 1mo ago A 93 tokens
Skill Claude CodeCodex
Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use…
not rated 455
+10
changed 1mo ago A 82 tokens
Skill Claude CodeCodex
Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, conditionally-valid-with-chain table, temp email creation scripts, XXE/deserialization/host header injection payloads. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command…
not rated 455
+10
changed 1mo ago E 126 tokens
Skill Claude CodeCodex
Comprehensive smart contract security audit framework with multi-expert analysis. Use for full audits of Ethereum / EVM Solidity and Vyper, Solana / SVM Anchor Rust, TON / FunC / Tact, or Sui / Move projects.
not rated 455
+10
changed 1mo ago A 55 tokens
Skill Claude CodeCodex
Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer…
not rated 455
+10
changed 1mo ago A 87 tokens
web2-recon
17Skill Claude CodeCodex
Web2 recon pipeline — subdomain enum, URL crawling, JS analysis, temp emails, directory fuzzing. Trust-first asset discovery.
not rated 455
+10
changed 1mo ago A 32 tokens
Skill Claude CodeCodex
Complete reference for 28 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, NoSQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI…
not rated 455
+10
changed 1mo ago F 232 tokens
web3-audit
19Skill Claude CodeCodex
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for…
not rated 455
+10
changed 1mo ago A 103 tokens
Skill Claude CodeCodex
AI-powered tools for Web3 bug bounty automation. Use when you want to automate recon, run autonomous audits, or use AI agents for vulnerability discovery.
not rated 455
+10
changed 1mo ago B 35 tokens
Skill Claude CodeCodex
Complete reference for all 10 DeFi smart contract bug classes. Use this when hunting for specific vulnerability types, need attack patterns for accounting desync, access control, incomplete path, off-by-one, oracle manipulation, ERC4626 vaults, reentrancy, flash loans, signature replay, or proxy/upgrade bugs.
not rated 455
+10
changed 1mo ago A 72 tokens
Skill Claude CodeCodex
Case study - role misconfiguration bug class applied to a yield aggregator protocol. Use as a template for applying all 10 bug classes to a single target.
not rated 455
+10
changed 1mo ago A 40 tokens
Skill Claude CodeCodex
Master grep command arsenal for Web3 smart contract auditing. Use when starting a new protocol scan, before deep code review, or when hunting specific vulnerability classes.
not rated 455
+10
changed 1mo ago A 39 tokens
Skill Claude CodeCodex
Hunter mindset, recon setup, and target scoring for Web3 bug bounty. Use at the START of any new protocol hunt - scoring targets, setting up environment, understanding architecture.
not rated 455
+10
changed 1mo ago A 42 tokens
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: