372 tagged bugbounty, measured the same way as everything else here.
Browse within: penetration-testing 245fuzzing 236reconnaissance 236reverse-engineering 234web-security 234ai-for-cybersecurity 111ai-orchestration 111bug 111bug-hunting/deep-dive-labs 14deep-dive 14exploitation 14lab-solutions 14portswigger 14zero-day 14
Skill Claude CodeCodex
Expert guide for the Osmedeus security automation workflow engine. Use when: (1) writing or editing YAML workflows (modules and flows), (2) running osmedeus CLI commands (scan, workflow management, installation, server), (3) configuring steps, runners, triggers, or template variables, (4) debugging workflow execution…
Skill Claude CodeCodex
Use when operating the metabigor CLI for OSINT recon and infrastructure mapping without API keys. Covers finding network ranges from an ASN, org, domain, or IP (net); enumerating subdomains from certificate logs (cert); enriching IPs with ports/CVEs via Shodan InternetDB (ip); searching public GitHub code for secrets…
Skill Claude CodeCodex needs its repo
Burp Suite scanning via MCP tools — passive traffic analysis, active payload testing, OOB verification, and vulnerability reporting using Burp's proxy, HTTP sender, Collaborator, and scanner APIs. Use when the user has Burp Suite running with the AI Agent MCP server and wants to scan, test, or analyze web traffic…
Skill Claude Code
Supabase / PostgREST Row-Level-Security playbook — pull the anon (or leaked servicerole) key out of the frontend JS, map tables from the auto-generated OpenAPI spec, test anonymous RLS READ disclosures (PII/secret leaks), and anonymous RLS WRITE abuse (insert/update/delete — e.g. forging…
Skill Claude Code
Drive extroosint with the right kind, feeds, pivots, and keys.
Skill Claude CodeCodex
Use when user asks to scan a target for exposed JavaScript secrets, run a jsrip scan, analyze findings for true/false positives, or says /jsrip-scan. Single-target bug bounty recon — runs jsrip then auto-classifies every finding.
Skill Claude CodeCodex needs its repo
Bug bounty findings secretary, tracker, and workspace initializer for the bb-huge portal. Use this skill for web security research, vulnerability hunting, and hunt workspace setup. Triggers on: "log finding", "save finding", "add to bb-huge", "record vulnerability", "update finding", "show findings", "bb-huge stats"…
Skill Claude CodeCodex
Bug bounty hunting and penetration testing skills for Claude, Codex, and other agentic AI tools.
vigilantshield/Claude-HunterKit
Skill Claude CodeCodex
Complete bug bounty workflow: recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload…
Olaradiallysymmetrical491/web3-bug-bounty-hunting-ai-skills
Skill Claude CodeCodex
Complete reference for all 10 DeFi smart contract bug classes. Use this when hunting for specific vulnerability types, need attack patterns for accounting desync, access control, incomplete path, off-by-one, oracle manipulation, ERC4626 vaults, reentrancy, flash loans, signature replay, or proxy/upgrade bugs.
Skill Claude CodeCodex
Operate only in authorized scope: bug bounty targets explicitly in scope, owned systems, defensive reviews, or labs. Decline or pause on requests involving unauthorized access, stealth, persistence, service disruption, credential abuse, real data theft, or abuse of third-party systems.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: