bug-bounty

What problem does it solve?

This Skill streamlines the end-to-end bug bounty workflow by guiding reconnaissance, targeted vulnerability hunting, evidence capture, and report writing—while enforcing validation to avoid wasting time on non-reportable results.

Core Features & Use Cases

• Master bug bounty orchestration: Plans and executes the full Recon → Learn/Intelligence → Hunt → Validate → Report loop for web apps, APIs, source code, and AI feature abuse.
• Vulnerability hunting coverage: Supports common high-impact classes (IDOR, SSRF, XSS, auth bypass, CSRF chains, race conditions, SQLi/NoSQLi, XXE, file upload bypasses, GraphQL auth gaps, HTTP smuggling, cache poisoning, OAuth/OIDC flows, SSTI, subdomain takeover, cloud misconfig, and ATO chaining).
• LLM/AI security testing: Tests prompt injection, indirect injection, chatbot IDOR, system prompt extraction attempts, code-tool abuse patterns, and agentic AI attack classes (ASI01–ASI10).
• Chain-first methodology: Systematically builds A→B→C exploit chains (e.g., IDOR→auth bypass, SSRF→metadata→RCE, XSS→session theft→ATO) to target paid outcomes.
• Validation discipline: Enforces “no theoretical bugs” and uses a 7-Question Gate approach to kill weak findings before reporting.
• Reporting & evidence support: Emphasizes impact-first writing, PoC generation guidance, and includes bypass tables (e.g., SSRF IP bypass, open redirect bypass, file upload bypass) plus language-oriented grep patterns.

Quick Start

Tell Claude: “I’m hunting an authorized bug bounty on target.com—start with scope verification, then run recon and propose the first highest-impact hunt path for IDOR and SSRF, including concrete request-level checks and what evidence to collect.”