817 tagged bug-bounty, measured the same way as everything else here.
Browse within: cybersecurity 474autonomous-pentesting 230blue-team 202ctf-tools 196cloud-security 188ethical-hacking 152bugcrowd 145cors-exploitation 145hackerone 144firebase-hacking 142hermes-agent 137jwt-attacks 121agents 115api-security 107
Skill Claude CodeCodex
Writing to the Neo4j attack-surface graph in RedAmon: the tenant-isolation MERGE key every entity node must carry, where graph methods live (mixins, not the client), and the schema places that must be updated together. A MERGE missing the tenant key silently merges one project's data into another's. Trigger: editing…
Skill Claude CodeCodex
Hunting skill for race condition vulnerabilities. Built from 12 public bug bounty reports including modern HTTP/2 single-packet attack cases (James Kettle DEF CON 2023 "Smashing the State Machine"; RyotaK / Flatt Security 10,000-request first-sequence-sync expansion 2024). Covers coupon double-redemption, gift-card…
Skill Claude CodeCodex
Implements data loss prevention policies using Microsoft Purview to protect sensitive information across Exchange Online, SharePoint, OneDrive, Teams, endpoint devices, and Power BI. The analyst configures sensitivity labels with encryption and content marking, creates DLP policies using built-in and custom sensitive…
Skill Cursor
Hunting skill for Insecure Direct Object Reference / Broken Object Level Authorization (BOLA — OWASP API1:2023). Built from 1,117 public IDOR bug bounty reports across HackerOne, Bugcrowd, Intigriti, GitHub Security Advisories, Huntr, plus 2024-2026 meta verified against NVD — Sam Curry's automotive chain…
Skill Claude CodeCodex
Digital forensics and incident response toolbox. Load when the operator asks about a pcap, a binary, a memory dump, a suspicious file, malware triage, IOC hunting, or post-incident analysis. Covers network (tshark), binaries (radare2, strings, binwalk, file, exiftool), memory (volatility), and pattern matching (YARA).…
Skill Codex
Use when the user asks how to build with OpenAI products or APIs, asks about Codex itself or choosing Codex surfaces, needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; use OpenAI docs MCP tools for non-Codex docs…
Skill Claude CodeCodex
No description is provided for this add-on.
Skill Claude CodeCodex
Cross-site scripting skill vision validation.
Skill Claude CodeCodex
Detect PII, credentials, and corporate sensitive data in API responses, source code, files, headers, and database extracts.
Awarexone/web3-bug-bounty-hunting-ai-skills
Skill Claude CodeCodex
Complete reference for all 10 DeFi smart contract bug classes. Use this when hunting for specific vulnerability types, need attack patterns for accounting desync, access control, incomplete path, off-by-one, oracle manipulation, ERC4626 vaults, reentrancy, flash loans, signature replay, or proxy/upgrade bugs.
Skill Claude Code
Active Directory attack reference — BloodHound Cypher queries, Kerberos attack decision tree, ACE/ACL abuse, ADCS ESC1-8, and AD misconfig checklist.
Skill Claude CodeCodex
A procedure for turning a confirmed security vulnerability into a submission-ready DOCX report. DOCX is the Microsoft Word document format.
Skill Claude CodeCodex
Use for ANY bug bounty, penetration test, or web/API/mobile security assessment: recon, testing endpoints, analyzing Burp traffic or any bug-bounty platform's MCP (HackerOne, Intigriti, Bugcrowd, YesWeHack, Immunefi), reviewing APKs, bypassing a WAF, enforcing scope, hunting a specific vuln class, validating findings…
Skill Claude CodeCodex
Automated API security testing starting from domains. Discovers REST, GraphQL, and SOAP APIs, reconstructs schemas, and tests for BOLA/IDOR, BFLA, mass assignment, JWT attacks, rate limiting bypass, and business logic flaws. Use when user asks to "test API security", "break API", "find API vulnerabilities", "test…
rhysha/claude-security-research-skill
Skill Claude CodeCodex
Full-spectrum security research skill for web servers, REST APIs, web applications, and network/port enumeration. Triggers whenever the user wants to: find vulnerabilities, run a security assessment, scan a target, test an API for security issues, enumerate ports or services, check for OWASP Top 10 vulnerabilities…
Skill Claude CodeCodex
Use when the user sends BB:, CTF:, Target:, or Pentest: followed by a domain or IP — activates autonomous JSON-only daemon mode for authorized penetration testing, bug bounty, and CTF challenges.
Skill Claude CodeCodex
Bug bounty hunting and penetration testing skills for Claude, Codex, and other agentic AI tools.
Skill Claude CodeCodex
Broken Access Control is OWASP #1, but there is no drop-in CLI (Autorize / AuthMatrix are Burp extensions). This is the procedure that carries the whole category: an authorization-matrix + A/B session-replay method driving curl, the playwright skill (per-identity sessions), and ffuf (ID enumeration). Live →…
vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
Complete bug bounty workflow: recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload…
Skill Claude CodeCodex
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct…
Skill Claude CodeCodex
Execute web-application assessment from setup and recon through injection, access control, auth/session issues, API, and SSRF chains.
Skill Claude CodeCodex
Create or validate a pwnote engagement import/export JSON file. Use when the user wants to generate, edit, or verify a pwnote engagement file for data transfer between pwnote instances. The file bundles an entire pentest engagement — metadata, notebook documents, code/host/credential blocks, findings with…
Skill Claude CodeCodex
Fast browser automation CLI for AI agents. Chrome/Chromium via CDP, no Playwright or Puppeteer dependency. Accessibility-tree snapshots with compact @eN refs let agents interact with pages in 200-400 tokens instead of parsing raw HTML.
ivan-sincek/threat-modeling-agent-skills
Skill Claude CodeCodex
Systematically identify and classify technical and business risks using the risk-centric PASTA threat modeling framework. Use when the user says "run PASTA", "do PASTA threat modeling", or "identify risks".
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: