elementalsouls/Claude-BugHunter

What it solves

Claude-BugHunter transforms Claude Code from a general-purpose chatbot into a specialized security researcher and red-team operator. It addresses the gap where generic AI prompts lack the specific methodology, current CVE knowledge, and reporting discipline required for professional bug hunting and external penetration testing.

How it works

The project provides a bundle of 83 "skills" (specialized instructions and knowledge) that integrate into the Claude Code skills system. These skills are organized into four layers:

• Think: Establishes a red-team mindset and a 5-phase non-linear workflow.
• Hunt webapps: Provides 58 skills based on 681 disclosed HackerOne reports, covering 24 core vulnerability classes (e.g., XSS, SQLi, SSRF).
• Hit the perimeter: Implements attack chains for enterprise platforms like M365, Okta, vCenter, and various SSL VPNs using 2024–2026 CVE chains.
• Ship it: Manages triage, validation (via a 7-Question Gate), and professional reporting for platforms like HackerOne and Bugcrowd.

Users can trigger these skills by describing their target in plain English, or use the /hunt scaffold and cbh CLI for structured engagement orchestration.

Who it’s for

Security researchers, bug bounty hunters, and authorized red-team operators who use Claude Code or other compatible agent harnesses (OpenCode, OpenAI Codex CLI, Hermes Agent, Google AntiGravity).

Highlights

• Extensive Knowledge Base: Includes 83 skills and 15 slash commands based on real-world disclosed reports and current CVEs.
• Multi-Harness Support: Compatible with multiple AI agent frameworks beyond Claude Code.
• Burp MCP Integration: Supports integration with Burp Suite via MCP.
• Strict Scope Enforcement: Specifically designed for external attack surfaces, with built-in validation gates to ensure authorized testing.
• Deterministic Engagement Engine: Maps a target's attack surface and routes findings to the appropriate skill.