skills.rest
ArianHobson333
ArianHobson333COMMUNITY
Explore all skills by this author →
GitHub

bug-bounty

Automate bug bounty hunting with recon, scanning, and reporting.

7|1|Updated Apr 14, 2026
Search Tags:#security testing#reporting#vulnerability scanning#bug bounty#recon#vulnerability hunting
One-click install
npx skills add https://github.com/ArianHobson333/claude-bug-bounty-stack --skill bug-bounty-arianhobson333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bug-bounty
Source: https://github.com/ArianHobson333/claude-bug-bounty-stack/tree/main/vendor/claude-bug-bounty
Command: npx skills add https://github.com/ArianHobson333/claude-bug-bounty-stack --skill bug-bounty-arianhobson333

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires nuclei, subfinder, httpx, subzy, arjun, paramspider, kiterunner, cloud_enum, trufflehog, gitleaks, xsstrike, secretfinder, sqlmap, subzy, ffuf, newrelic, anew, qsreplace, assetfinder, interactsh-client, semgrep, turbo-intruder, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the bug bounty hunting workflow, saving time and increasing efficiency in security testing.

Core Features & Use Cases

  • Automated Recon: Subdomain enumeration, live host discovery, URL crawling, and nuclei scanning.
  • Vulnerability Hunting: IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI.
  • LLM/AI Security Testing: Chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10.
  • A-to-B Bug Chaining: IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth.
  • Bypass Tables: SSRF IP bypass, open redirect bypass, file upload bypass.
  • Language-specific Grep: JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap.
  • Reporting: 7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist.
  • Use Case: Imagine you are auditing a web application for security vulnerabilities. Use this Skill to automate the recon, scanning, validation, and reporting stages, saving you time and reducing the risk of missing important vulnerabilities.

Quick Start

Use the bug-bounty skill to start a new hunt for the target 'example.com'.

Frequently Asked Questions about bug-bounty

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate bug bounty recon and vulnerability scanning?▼

Automate bug bounty recon by running subdomain enumeration, live host discovery, and URL crawling, followed by nuclei scanning to identify common security vulnerabilities across web applications.

What is A-to-B bug chaining in vulnerability hunting?▼

A-to-B bug chaining in vulnerability hunting links individual flaws like IDOR, SSRF, and XSS into exploit chains to achieve larger impacts like authentication bypass or account takeover.

How do I test for LLM and AI security vulnerabilities?▼

Test LLM and AI security vulnerabilities by scanning for chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, and system prompt extraction to prevent data exfiltration.

Do I need Python and tools like nuclei and subfinder to run automated security testing?▼

Yes, you need Python and various tools like nuclei, subfinder, httpx, sqlmap, and semgrep installed in your environment to execute the automated vulnerability scanning workflows.

How do I generate bug bounty reports with CVSS scores and PoC?▼

Generate bug bounty reports by utilizing validation gates, human-tone writing templates, CVSS 3.1 scoring, and automated Proof of Concept generation tailored to the discovered vulnerability class.

What is the best way to find subdomain takeover and cloud misconfigurations?▼

Find subdomain takeover and cloud misconfigurations by utilizing automated discovery tools like subzy and cloud_enum to detect dangling DNS records and exposed storage buckets.

Related Skills

Explore More Software Engineering Skills→
AndyAnh174AndyAnh174

Red Team Tools and Methodology

Automate reconnaissance, subdomain enumeration, and vulnerability scanning with red team tools.

Community
Advanced
cybersecwomancybersecwoman
5

report-writing

Generate bug bounty reports with impact statements and CVSS scoring.

Community
Advanced
jMertajMerta
130

vps-checkup

Automate a read-only health and security review for an Ubuntu VPS running Docker.

Community
Advanced
cxnaivecxnaive

web-pentest

Perform authorized web application penetration testing with reconnaissance, vulnerability analysis, and proof-based exploitation.

Community
Advanced