skills.rest
azusagasaku
azusagasakuCOMMUNITY
Explore all skills by this author →
GitHub

security-bounty-hunter

Detects remotely exploitable vulnerabilities in repositories for bounty and disclosure reports.

Updated May 19, 2026
Search Tags:#security#sql injection#vulnerability scanning#semgrep#ssrf#bug bounty#responsible disclosure
One-click install
npx skills add https://github.com/azusagasaku/--claude-config --skill security-bounty-hunter-azusagasaku
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-bounty-hunter
Source: https://github.com/azusagasaku/--claude-config/tree/main/skills/ecc/security-bounty-hunter
Command: npx skills add https://github.com/azusagasaku/--claude-config --skill security-bounty-hunter-azusagasaku

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security researchers waste time triaging noisy static analysis findings that bounty platforms reject as out of scope or non-exploitable. This Skill focuses vulnerability discovery on remotely reachable, user-controlled attack paths that qualify for real bounty submissions. ## Core Features & Use Cases - In-Scope Pattern Matching: Targets high-impact vulnerability classes including SSRF (CWE-918), auth bypass (CWE-287), deserialization-to-RCE (CWE-502), SQL injection (CWE-89), command injection (CWE-78), path traversal (CWE-22), and auto-triggered XSS (CWE-79). - Noise Filtering: Explicitly skips low-signal findings such as local-only pickle.loads, CLI-only eval, hardcoded shell commands, missing security headers, and self-XSS. - Structured Reporting: Provides a report template covering description, vulnerable code, proof of concept, impact, and affected version, plus a quality gate checklist before submission. - Use Case: Before submitting to Huntr or HackerOne, run Semgrep triage on a target repository, manually filter to reachable network entrypoints, prove user-controlled input reaches a meaningful sink, and draft a deduplicated report. ## Quick Start Scan this repository for remotely exploitable, bounty-worthy vulnerabilities and draft a report for the most impactful finding.

Frequently Asked Questions about security-bounty-hunter

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find exploitable vulnerabilities in a repository for bug bounties?▼

Start by checking program scope and SECURITY.md, then map real entrypoints like HTTP handlers, uploads, and webhooks. Run Semgrep for triage, read the full code path, and prove user-controlled input reaches an exploitable sink before reporting.

What vulnerability types qualify for bug bounty submissions?▼

Remotely reachable issues with real impact qualify: SSRF, authentication bypass, remote deserialization, SQL injection, command injection, path traversal, and auto-triggered XSS. Local-only or theoretical findings are routinely rejected as out of scope.

Which findings should I skip during vulnerability triage?▼

Skip local-only pickle.loads or torch.load with no remote path, eval in CLI-only tools, shell=True on hardcoded commands, missing security headers alone, self-XSS, and demo or test-only code. These are low-signal for bounty programs.

Does Semgrep replace manual code review for security research?▼

No. Semgrep output is triage input only. You must manually filter out tests, demos, and vendored code, then read the real code path end to end to confirm reachability and exploitability before drafting a report.

What should a bug bounty vulnerability report include?▼

Include a description of the vulnerability, the vulnerable code path with file and line references, a minimal working proof of concept, the attacker impact, and the affected version or commit tested. Verify the issue is not a known duplicate first.

Related Skills

Explore More Software Engineering Skills→
kaminocorpkaminocorp
1

Scope Assessment

Verifies a target repository is in-scope for its bug bounty program before analysis.

Official
Intermediate
MaelwalserMaelwalser

security-bounty-hunter

Scan code repositories for exploitable vulnerabilities and produce concise reports with proof-of-concept.

Community
Intermediate
ArianHobson333ArianHobson333
7

exploiter-overview

Automate exploit chain construction from validated findings for security testing.

Community
Advanced
himanshu231204himanshu231204
2

security-bounty-hunter

Identify exploitable, bounty-eligible vulnerabilities in software repositories.

Community
Intermediate