security-bounty-hunter

Identify and validate remotely reachable exploitable security vulnerabilities in a repository.

1|Updated Apr 6, 2026

Search Tags:#security #vulnerability #triage #pentesting #cwe #bounty

Ready to run

npx skills add https://github.com/vrcms/everything-qwen-code --skill security-bounty-hunter-vrcms

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-bounty-hunter
Source: https://github.com/vrcms/everything-qwen-code/tree/main/.qwen/skills/security-bounty-hunter
Command: npx skills add https://github.com/vrcms/everything-qwen-code --skill security-bounty-hunter-vrcms

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps developers and security researchers filter out noisy, non-exploitable findings to focus exclusively on high-impact, remotely reachable vulnerabilities that qualify for real-world bug bounty programs.

Core Features & Use Cases

Vulnerability Triage: Automatically prioritizes remotely reachable attack paths like SSRF, SQL injection, and RCE.
Bounty-Ready Reporting: Provides a structured template for documenting findings to meet the standards of platforms like HackerOne or Huntr.
Use Case: Use this skill when auditing a web application to quickly identify and document a critical authentication bypass that is actually exploitable from the network boundary.

Quick Start

Use the security-bounty-hunter skill to scan the current repository for remotely reachable vulnerabilities and generate a professional report.

Frequently Asked Questions about security-bounty-hunter

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify remotely reachable vulnerabilities like SSRF and SQL injection in a repository?▼

To identify remotely reachable vulnerabilities like SSRF and SQL injection, the skill scans the repository to filter out low-signal local-only patterns, validating exploitable attack vectors for responsible disclosure or bounty submission.

What is the best way to triage security findings for bug bounty programs?▼

The best way to triage security findings for bug bounty programs is to automatically prioritize high-impact, remotely reachable attack paths like RCE over noisy, non-exploitable findings to meet real-world program standards.

How do I generate a proof-of-concept exploit for a verified security bug?▼

To generate a proof-of-concept exploit for a verified security bug, the skill requires adherence to specific bounty program scopes and produces minimal PoC exploits alongside structured documentation for verified findings.

Can I use this skill to document findings for platforms like HackerOne or Huntr?▼

Yes, you can use this skill to document findings for platforms like HackerOne or Huntr, as it provides a structured reporting template specifically designed to meet the standards of real-world bug bounty programs.

Does this vulnerability triage approach filter out local-only security patterns?▼

Yes, this vulnerability triage approach filters out local-only security patterns, focusing exclusively on high-impact, remotely reachable network boundary attack vectors such as SSRF, SQL injection, and remote code execution.