{"id":"4784a3b9-1891-4c45-b076-aec52bb7881f","slug":"bug-hunting","kind":"skill","name":"bug-hunting","summary":"Bug bounty hunting & penetration testing skills for Claude, Codex, and any agentic coding tool.","owner":"m4vic","repoUrl":"https://github.com/m4vic/bug-hunting","license":"MIT","licenseTier":"permissive","trust":"community","stars":14,"match":null,"fewStars":false,"format":"skill","createdAt":"2026-08-25T19:03:10.000Z","addedAt":"2026-10-14T05:56:21.893Z","logoUrl":"https://avatars.githubusercontent.com/u/142510080?u=fe82e2f64fe696c0bef8cb83d870fb0030b23158&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools"],"tags":["bug-bounty","bug-hunting-skills","bugbounty","claude","claudeskills","cybersecurity-skills","penetration-testing","bug-bounty-skills"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-20T20:17:59.914Z","sample":false,"url":"https://conduits.dev/tools/bug-hunting","language":"","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"

\n \"Bug\n

\n\n

\n \"GitHub\n \"Version\"\n \"License:\n \"GitHub\n

\n\n# Bug Hunting Skill\n\n**Bug bounty hunting & penetration testing skills for Claude, Codex, and any agentic coding tool.**\n\nA signal-driven, structured skill package that turns a general-purpose coding agent into a disciplined web/API/mobile/cloud/AI-LLM vulnerability hunter — not by dumping a wall of technique text into context, but by routing to only what's relevant, and by making the agent actually *operate* like a hunter (working folders, hypothesis tracking, confirm-before-report), not just recite vuln classes.\n\n---\n\n## What this is\n\nMost \"hacking skill\" packs for AI agents are a single giant file, or dozens of files, each 300–500+ lines, loaded all at once regardless of relevance — heavy on payout tables and named bug-bounty programs, thin on the actual decision logic a hunter needs mid-recon. That's expensive on tokens and worse, it drowns the model in procedure instead of teaching it how to *think*.\n\nThis skill is built the opposite way: a tiny router at the top, six domain-specific signal tables underneath, and 70+ compact technique references that only load when a signal table actually points at them. Nothing loads until it's needed.\n\n## What it consists of\n\n```\nbug-hunting/\n SKILL.md <- entry point. Routes by target type. ~50 lines.\n methodology/\n workflow.md <- the operating discipline (see below) — run first\n mindset.md <- map-wide / hypothesize-wide / confirm-strict loop\n reporting.md <- how to write up a finding that gets paid, not closed\n web/ ROUTER.md + references/ (34 vuln classes + 6 framework fingerprints)\n api/ ROUTER.md + references/ (GraphQL, gRPC, WebSocket, shadow APIs, ...)\n mobile/ ROUTER.md + references/ (Android, iOS, thick-client reversing)\n cloud-identity/ ROUTER.md + references/ (cloud/K8s/CI-CD, SAML/Okta/Entra/LDAP/VPN)\n ai-llm/ ROUTER.md + references/ (prompt injection, jailbreak, RAG poisoning, agent/tool abuse)\n recon/ ROUTER.md + references/ (subdomain enum, OSINT, secrets, source leaks)\n```\n\n**79 markdown files total.** Every `ROUTER.md` is a signal table: *observable thing about this target → plausible vuln class(es) → one-line confirmation test → which reference file to open for depth.* Every `references/*.md` is a compact, technique-dense distillation — real payloads, real bypasses, real exploit chains — with the payout-table and named-program filler stripped out.\n\n## How it's meant to be used\n\n1. Point the agent at a target. It loads `SKILL.md` (a few hundred tokens), which sends it to `methodology/workflow.md` first — not a vuln class.\n2. `workflow.md` has it set up a **real per-target working folder** (`scope.md`, `recon/`, `hypothesis-log.md`, `findings/`, `session-notes.md`) before a single request goes out, and gates it from jumping to exploitation before recon is actually marked done.\n3. Based on what the target looks like (web app, API, mobile app, cloud/identity surface, AI/LLM feature), `SKILL.md` routes to exactly one domain `ROUTER.md`.\n4. The router's signal table points at plausible classes; only the matching `references/*.md` file loads for depth — not the other 78.\n5. Every hypothesis tried, confirmed, or refuted gets logged, so a long session never re-tests the same thing twice.\n6. A finding only becomes a report once it clears `methodology/reporting.md`'s validation bar — reproduced, in scope, evidence captured.\n\nThat loop — map wide, hypothesize wide, confirm strict, track everything, report only what's proven — is the actual discipline that separates hunters who find real bugs from people who know the same techniques but don't systematize them. Most skill packs teach the techniques and skip this; this one leads with it.\n\n## Who this is for\n\n- **Bug bounty hunters and pentesters** using Claude Code, Codex, or any agentic tool as a hands-on research assistant on an authorized target.\n- **Security tool builders** who want a structured, signal-driven technique reference to encode into their own scanners, mappers, or exploit modules — the signal tables are designed to be directly translatable into rule-based or LLM-driven attack-mapping logic.\n- **Anyone learning offensive web/API/mobile/cloud/AI security** who wants a reference organized the way a working hunter actually uses one — by observable signal, not alphabetically by CVE.\n\n## Compatibility\n\n**Not Claude-only.** Every file in this skill is plain, self-contained markdown — no Claude API calls, no Anthropic-specific syntax, nothing tool-locked anywhere in the actual content. The one Claude Code–specific piece is `SKILL.md`'s YAML frontmatter (`name:` / `description:`), which is a Claude Code *auto-discovery* convention — it's what lets Claude Code find and load this skill on its own, without being told to.\n\nThat means the difference between tools is **auto-discovery vs. manual pointing**, not compatibility:\n\n- **Claude Code** — drop `bug-hunting/` into your skills directory; the frontmatter makes it auto-discoverable, no manual pointing needed.\n- **Codex, Antigravity, Cursor, or any other agentic coding tool** — these don't recognize the `SKILL.md` auto-discovery convention, but that's a discovery mechanism, not a content restriction: just point the agent at `bug-hunting/SKILL.md` directly (\"read this and follow it\") or hand it the relevant domain `ROUTER.md` for the engagement at hand, and it works identically — everything past the frontmatter is ordinary markdown any agent can read and reason over.\n- **A standalone human reference** — every file reads fine on its own in a browser or editor, frontmatter and all.\n\n## Scope and legal\n\nThis skill assumes **authorized testing only** — an in-scope bug-bounty program you've read the rules for, your own systems, or a lab you control. `SKILL.md` states this explicitly and every workflow step checks against a written `scope.md` before acting. Nothing here is a substitute for reading the actual program rules of whatever you're testing.\n\n## Status\n\nBuilt by compressing and restructuring a larger, less organized technique-file collection into this signal-first shape. Reference content is dense but not exhaustive — if you find a gap, extend the matching domain's `ROUTER.md` and add a `references/` file the same way the existing ones are structured (signal table entry → short technique file, no payout tables, no filler).\n\n## License\n\n[MIT](LICENSE) — use it, fork it, adapt it, commercial or not. Just keep the copyright notice.\n"}