bugskill-ai

An enterprise-grade repository combining 9,950+ real-world disclosed HackerOne bug bounty reports ($3.26M+ in bounties paid) with two curated, modular collections comprising 162 Universal AI Agent Skills (Awesome-Claude-Code-Agent-Skills/ [159 skills across 10 specialized domains] & Personal-Claude-Code-Agent-Skills/ [3 deep HackerOne vulnerability intelligence skills]) built for next-generation AI coding assistants: Claude Code, Gemini CLI, Google Antigravity, ChatGPT / Codex CLI, and Cursor.

📑 Table of Contents

• 📊 Dataset Overview
• 📦 Curated Agent Skills Collections
  • 1. Awesome Claude Code Skills (Awesome-Claude-Code-Agent-Skills/)
  • 2. Personal Bug Bounty Intelligence Skills (Personal-Claude-Code-Agent-Skills/)
• 📁 Clean Repository Layout
• ⚡ Zero External Dependencies
• 🤖 Universal Agent Skills Framework ("Using It")
  • 1. Cross-Agent Compatibility Matrix
  • 2. One-Command Universal Sync
  • 3. Using with Claude Code
  • 4. Using with Gemini CLI & Google Antigravity
  • 5. Using with ChatGPT / Codex CLI
  • 6. Using with Cursor / VS Code
• 🔎 Offline Report Search & Intelligence CLI (search_reports.py)
• ⚡ HackerOne Hacktivity Downloader (hackerone_public.py)
• 📜 License & Responsible Disclosure

📊 Dataset Overview

The repository includes an offline intelligence dataset of 9,950 disclosed vulnerability reports fetched directly from the official HackerOne Hacktivity REST API.

📦 Curated Agent Skills Collections

1. Awesome Claude Code Skills (Awesome-Claude-Code-Agent-Skills/)

A curated, production-ready collection of 159 specialized offensive security, penetration testing, reverse engineering, and AI agent skills organized across 10 security domains:

Category Breakdown of Awesome Skills (159 Skills)

🎯 Reconnaissance, Footprinting & OSINT (15 Skills)

🌐 Web Application Exploitation & Injections (45 Skills)

🔑 Authentication, Authorization & Access Control (25 Skills)

🏢 Active Directory & Windows Exploitation (7 Skills)

🐧 Linux, Containers & Cloud Security (6 Skills)

⚡ Binary Exploitation, Reverse Engineering & macOS (16 Skills)

📱 Mobile & Smart Contract Security (12 Skills)

🔐 Cryptography & Cryptanalysis (6 Skills)

🧠 AI / LLM Security & Agent Orchestration (10 Skills)

🛡️ DevSecOps, Defense & Workflow Automation (17 Skills)

2. Personal Bug Bounty Intelligence Skills (Personal-Claude-Code-Agent-Skills/)

Custom, deep vulnerability analysis skills derived directly from real-world HackerOne disclosed reports:

📁 Clean Repository Layout

.
├── README.md                              # Repository documentation & universal agent guide
├── Assets/                                # Media assets & project branding
│   └── BugSkill-AI-Logo.png               # Official BugSkill AI Logo
├── requirements.txt                       # Dependency notes (Zero external dependencies)
├── search_reports.py                      # Offline multi-filter search CLI (Python stdlib)
├── hackerone_public.py                    # HackerOne API Hacktivity downloader (Python stdlib)
├── hackerone_public_reports.json          # Offline dataset (9,950 disclosed reports)
│
├── Awesome-Claude-Code-Agent-Skills/      # 🌟 Curated Security Skills (159 Skills across 10 Domains)
│   ├── 01-Reconnaissance-and-OSINT/       # ApexDiscovery, AsnRecon, SubdomainEnum, crawl, jsa...
│   ├── 02-Web-Application-Security/       # SQLi, SSRF, SSTI, XSS, XXE, CMDi, CacheDeception...
│   ├── 03-Authentication-and-Access-Control/ # 401/403 bypass, BOLA/IDOR, JWT/OAuth, SAML...
│   ├── 04-Active-Directory-and-Windows/   # AD CS, Kerberos, NTLM relay, PrivEsc, AV evasion...
│   ├── 05-Linux-Containers-and-Cloud/     # Kubernetes, container escapes, Linux PrivEsc...
│   ├── 06-Binary-and-Reverse-Engineering/ # Heap, format strings, kernel, V8, macOS injection...
│   ├── 07-Mobile-and-Smart-Contracts/     # Android/iOS pentesting, SSL pinning, DeFi...
│   ├── 08-Cryptography-and-Cryptanalysis/ # RSA, Lattice, Hash attacks, Steganography...
│   ├── 09-AI-Security-and-Orchestration/  # Prompt injection, AI/ML security, skillabc, hack...
│   └── 10-DevSecOps-and-Defense/          # TabletopExercise, BugBountyWorkflow, Code auditor...
│
└── Personal-Claude-Code-Agent-Skills/     # 🛡️ HackerOne Intelligence Skills (Custom Reports)
    ├── Note.md                            # Master ledger of converted HackerOne report IDs
    ├── otp-bruteforce-testing/            # OTP Brute-Force & Oracle Testing (H1 #3265780)
    ├── stack-bounds-format-auditing/      # Stack Buffer Overflow & Bounds Auditing (H1 #2551512)
    └── url-parser-confusion-testing/      # URL Parser Inconsistencies & SSRF Bypass (H1 #3923212)

⚡ Zero External Dependencies

All core utilities, dataset search tools, and primary skill scripts are written natively using the Python 3 Standard Library (Python 3.8+):

• search_reports.py (json, argparse, pathlib, collections)
• hackerone_public.py (urllib.request, base64, json, argparse)
• Personal-Claude-Code-Agent-Skills/* (urllib.request, threading, json, argparse, ipaddress, subprocess)

No third-party packages or pip install steps are required for core operations.

🤖 Universal Agent Skills Framework ("Using It")

Every skill in this repository contains structured instructions and workflows making it compatible across all major agent environments.

1. Cross-Agent Compatibility Matrix

2. One-Command Universal Sync

Install all skills into your local agent environment with a single command:

Linux / macOS (Bash / Zsh):

# Sync ALL skills to Claude Code (Project Scope)
mkdir -p .claude/skills
cp -r Awesome-Claude-Code-Agent-Skills/*/* .claude/skills/
cp -r "Personal-Claude-Code-Agent-Skills/"* .claude/skills/

# Sync ALL skills to Claude Code (Global Scope)
mkdir -p ~/.claude/skills
cp -r Awesome-Claude-Code-Agent-Skills/*/* ~/.claude/skills/
cp -r "Personal-Claude-Code-Agent-Skills/"* ~/.claude/skills/

# Sync ALL skills to Gemini CLI, Google Antigravity & Codex
mkdir -p ~/.agents/skills
cp -r Awesome-Claude-Code-Agent-Skills/*/* ~/.agents/skills/
cp -r "Personal-Claude-Code-Agent-Skills/"* ~/.agents/skills/

Windows (PowerShell):

# Sync ALL skills to Claude Code (Project Scope)
New-Item -ItemType Directory -Force -Path ".claude\skills"
Get-ChildItem -Path "Awesome-Claude-Code-Agent-Skills\*\*" -Directory | Copy-Item -Destination ".claude\skills\" -Recurse -Force
Copy-Item -Recurse -Force "Personal-Claude-Code-Agent-Skills\*" ".claude\skills\"

# Sync ALL skills to Gemini CLI, Google Antigravity & Codex
New-Item -ItemType Directory -Force -Path "$HOME\.agents\skills"
Get-ChildItem -Path "Awesome-Claude-Code-Agent-Skills\*\*" -Directory | Copy-Item -Destination "$HOME\.agents\skills\" -Recurse -Force
Copy-Item -Recurse -Force "Personal-Claude-Code-Agent-Skills\*" "$HOME\.agents\skills\"

3. Using with Claude Code

Direct Slash Commands

/403Bypass
/SubdomainEnum
/ApexDiscovery
/JsAnalyzer
/TabletopExercise
/otp-bruteforce-testing
/url-parser-confusion-testing
/stack-bounds-format-auditing

Natural Prompting (Auto-Invocation)

Claude Code automatically indexes skill descriptions and activates them dynamically when you describe relevant security tasks:

"Perform subdomain enumeration and prioritize live targets for example.com." "Audit our authentication API for OTP brute-force bypasses."

4. Using with Gemini CLI & Google Antigravity

• Auto-Discovery: Antigravity and Gemini CLI automatically load and execute any skill located in .agents/skills/ or ~/.agents/skills/.
• Natural Execution: Prompt the agent with the target domain or source code to audit.

5. Using with ChatGPT / Codex CLI

• Codex CLI reads skills from .agents/skills/ or ~/.codex/skills/.
• List active skills with codex /skills.

6. Using with Cursor / VS Code

• Add skill references in .cursorrules or @mention any SKILL.md file directly in the chat panel.

🔎 Offline Report Search & Intelligence CLI (search_reports.py)

Search and analyze the 9,950+ disclosed reports dataset offline with sub-second execution:

# 1. Global keyword search
python search_reports.py "OTP"
python search_reports.py "IDOR"
python search_reports.py "SSRF"

# 2. Filter by severity and minimum bounty
python search_reports.py "bypass" --severity critical --min-bounty 2500

# 3. Filter by CWE category
python search_reports.py --cwe "CWE-307"
python search_reports.py --cwe "CWE-79" --limit 10

# 4. Filter by target company/program
python search_reports.py --program "shopify" --severity high

# 5. Inspect deep report details by ID
python search_reports.py --id 3265780
python search_reports.py --id 2551512

# 6. Display high-level dataset statistics
python search_reports.py --stats

# 7. Output structured JSON for scripts and CI/CD pipelines
python search_reports.py "RCE" --severity critical --json

⚡ HackerOne Hacktivity Downloader (hackerone_public.py)

To refresh or append newly disclosed reports directly from the HackerOne REST API:

1. Obtain your API Identifier and Token from HackerOne Settings -> API.
2. Set your environment variables:

# Linux / macOS
export H1_API_IDENTIFIER="YOUR_IDENTIFIER"
export H1_API_TOKEN="YOUR_TOKEN"

# Windows (PowerShell)
$env:H1_API_IDENTIFIER="YOUR_IDENTIFIER"
$env:H1_API_TOKEN="YOUR_TOKEN"

3. Run the downloader:

# Download latest 10 pages (500 reports)
python hackerone_public.py --max-pages 10

# Download all disclosed reports (0 = unlimited)
python hackerone_public.py --max-pages 0 --output hackerone_public_reports.json

📜 License & Responsible Disclosure

• License: Distributed under the MIT License.
• Responsible Disclosure & Ethics: All disclosed vulnerability reports in this dataset are public data published by HackerOne under mutual agreement with respective security teams. This toolkit is intended solely for authorized security assessments, defensive hardening, and educational research. Always obtain explicit authorization before testing any third-party infrastructure.