Mikacr1138Mikacr1138/claude-bug-bounty/CLAUDE.md

claude-bug-bounty

CLAUDE.md3 starsChanged 8 months agoMITView on GitHub

This repo is a Claude Code plugin for professional bug bounty hunting across HackerOne, Bugcrowd, Intigriti, and Immunefi. Located in repo root: - hunt.py — master orchestrator - reconengine.sh — subdomain + URL discovery - validate.py — 4-gate finding validator - reportgenerator.py — report writer - learn.py — CVE + disclosure intel

We split this CLAUDE.md into the rules it gives an agent

3 rules. About 0 are common, 3 are distinctive, and 0 are very specific to this project.

≈0
Common · estimate
Many files like this have a rule of this kind.
≈3
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Distinctive:
READ FULL SCOPE before touching any asset
line 72
Distinctive:
NEVER hunt theoretical bugs — "Can attacker do this RIGHT NOW?"
line 73
Distinctive:
Run 7-Question Gate BEFORE writing any report
line 74

≈ “Common” is an estimate: at least 1 in 5 of the 25,680 CLAUDE.md files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

CLAUDE.md

Claude Bug Bounty — Plugin Guide

This repo is a Claude Code plugin for professional bug bounty hunting across HackerOne, Bugcrowd, Intigriti, and Immunefi.

What's Here

Skills (7 domains — load with `/bug-bounty`, `/web2-recon`, etc.)

Skill	Domain
`skills/bug-bounty/`	Master workflow — recon to report, all vuln classes, LLM testing, chains
`skills/web2-recon/`	Subdomain enum, live host discovery, URL crawling, nuclei
`skills/web2-vuln-classes/`	18 bug classes with bypass tables (SSRF, open redirect, file upload, Agentic AI)
`skills/security-arsenal/`	Payloads, bypass tables, gf patterns, always-rejected list
`skills/web3-audit/`	10 smart contract bug classes, Foundry PoC template, pre-dive kill signals
`skills/report-writing/`	H1/Bugcrowd/Intigriti/Immunefi report templates, CVSS 3.1, human tone
`skills/triage-validation/`	7-Question Gate, 4 gates, never-submit list, conditionally valid table

Commands (8 slash commands)

Command	Usage
`/recon`	`/recon target.com` — full recon pipeline
`/hunt`	`/hunt target.com` — start hunting
`/validate`	`/validate` — run 7-Question Gate on current finding
`/report`	`/report` — write submission-ready report
`/chain`	`/chain` — build A→B→C exploit chain
`/scope`	`/scope <asset>` — verify asset is in scope
`/triage`	`/triage` — quick 7-Question Gate
`/web3-audit`	`/web3-audit <contract.sol>` — smart contract audit

Agents (5 specialized agents)

recon-agent — subdomain enum + live host discovery
report-writer — generates H1/Bugcrowd/Immunefi reports
validator — 4-gate checklist on a finding
web3-auditor — smart contract bug class analysis
chain-builder — builds A→B→C exploit chains

Rules (always active)

rules/hunting.md — 17 critical hunting rules
rules/reporting.md — report quality rules

Tools (Python/shell — run directly)

Located in repo root:

hunt.py — master orchestrator
recon_engine.sh — subdomain + URL discovery
validate.py — 4-gate finding validator
report_generator.py — report writer
learn.py — CVE + disclosure intel

Start Here

claude
# /recon target.com
# /hunt target.com
# /validate   (after finding something)
# /report     (after validation passes)

Install Skills

chmod +x install.sh && ./install.sh

Critical Rules (Always Active)

READ FULL SCOPE before touching any asset
NEVER hunt theoretical bugs — "Can attacker do this RIGHT NOW?"
Run 7-Question Gate BEFORE writing any report
KILL weak findings fast — N/A hurts your validity ratio
5-minute rule — nothing after 5 min = move on

Download now (ZIP)

In this repository8 other files it gives its agents.
- bug-bountySkill
- bug-bountySkill
- report-writingSkill
- security-arsenalSkill
- triage-validationSkill
- web2-reconSkill
- web2-vuln-classesSkill
- web3-auditSkill

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free