skills.rest
cybersecwoman
cybersecwomanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

bb-local-toolkit

Coordinate bug bounty workflows from reconnaissance through reporting.

5|Updated May 27, 2026
Search Tags:#security testing#reconnaissance#reporting#bug bounty#vulnerability hunting#source code audit
One-click install
npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill bb-local-toolkit-cybersecwoman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bb-local-toolkit
Source: https://github.com/cybersecwoman/Kiro-BugHunter/tree/main/skills/bb-local-toolkit
Command: npx skills add https://github.com/cybersecwoman/Kiro-BugHunter --skill bb-local-toolkit-cybersecwoman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides a comprehensive toolkit for bug bounty hunters, addressing the entire workflow from reconnaissance to report generation, ensuring a systematic and efficient approach to identifying and validating vulnerabilities.

Core Features & Use Cases

  • Comprehensive Recon: Offers tools for subdomain enumeration, asset discovery, fingerprinting, and source code audit.
  • Pre-Hunt Learning: Provides resources for disclosed reports, tech stack research, mind maps, and threat modeling.
  • Vulnerability Hunting: Focuses on IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, and agentic AI.
  • LLM/AI Security Testing: Incorporates AI features for chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, and ASI01-ASI10.
  • A-to-B Bug Chaining: Offers methodologies for chaining vulnerabilities for maximum impact.
  • Bypass Tables: Provides tables for SSRF IP bypass, open redirect bypass, and file upload bypass.
  • Language-Specific Grep: Includes grep patterns for JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, and Rust unwrap.
  • Reporting: Offers guidelines for the 7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, and submission checklist.

Quick Start

Use the bb-local-toolkit skill to initiate a bug bounty engagement on a target.

Frequently Asked Questions about bb-local-toolkit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is bug bounty hunting and how does reconnaissance fit into the workflow?▼

Bug bounty hunting is the systematic identification of web application security vulnerabilities. Reconnaissance serves as the initial phase, focusing on subdomain enumeration, asset discovery, fingerprinting, and source code audit to map the target's attack surface before active testing.

How do I test for LLM and AI prompt injection vulnerabilities?▼

To test LLM and AI prompt injection, you target chatbot IDOR, indirect injection, ASCII smuggling, exfil channels, and system prompt extraction. The methodology also covers RCE via code tools and standardized ASI01-ASI10 AI security testing categories.

Can I use this bug bounty toolkit for source code auditing and specific vulnerability grep patterns?▼

Yes, you can use this toolkit for source code auditing. It includes language-specific grep patterns to detect vulnerabilities like JS prototype pollution, Python pickle deserialization, PHP type juggling, Go template.HTML, Ruby YAML.load, and Rust unwrap.

How do I chain vulnerabilities together to maximize bug bounty impact?▼

You chain vulnerabilities by using A-to-B bug chaining methodologies, combining lower severity flaws like IDOR, SSRF, or auth bypass to achieve higher impact sequences. This includes leveraging conditional chain tables to validate and document the attack flow.

What is the best way to write a bug bounty report that gets accepted?▼

The best way to write accepted bug bounty reports involves using the 7-Question Gate and 4 validation gates for human-tone writing. Include CVSS 3.1 scores, clear PoC generation, vulnerability class templates, and verify against an always-rejected list before submission.

Does this toolkit provide bypass tables for SSRF and open redirect testing?▼

Yes, the toolkit provides specific bypass tables for SSRF IP bypass, open redirect bypass, and file upload bypass. These tables assist in vulnerability hunting by offering known techniques to evade common input filters and web application firewalls.

Related Skills

Explore More Software Engineering Skills→
transilienceaitransilienceai
462

domain-assessment

Coordinate subdomain discovery and port scanning to build a domain attack surface inventory.

Official
Basic
jinyimeng01jinyimeng01
54

report-agent

Generate HackerOne-format vulnerability reports from validated security findings.

Community
Advanced
SkobynSkobyn

security-arsenal

Provide security payloads and bypass techniques for testing web application vulnerabilities.

Community
Advanced
mlvpatelmlvpatel
1

apex-pipeline

Orchestrate seven-phase application security testing from intake to report.

Community
Advanced