elementalsouls/Claude-BugHunter

What it solves

claude-bughunter is a skill bundle designed to transform Claude Code from a general-purpose chatbot into a specialized senior bug-hunting researcher and red-team operator. It addresses the gap where generic AI prompts fail to provide the discipline, specific vulnerability patterns, and reporting hygiene required for professional security assessments.

How it works

The project provides a set of 83 skills and 15 slash commands that can be installed as a plugin or copied into the agent's skill directory. It operates across four layers:

• Think: Implements a 5-phase non-linear workflow and a red-team mindset for critical thinking.
• Hunt webapps: Uses 58 skills based on 681 disclosed HackerOne reports to detect vulnerability classes like XSS, SQLi, and SSRF.
• Hit the perimeter: Provides attack chains for enterprise platforms (e.g., M365/Entra, Okta, vCenter) and current CVE chains (2024–2026).
• Ship it: Handles triage validation via a "7-Question Gate," VRT-aware severity mapping, and professional reporting.

Users can trigger these skills by describing their testing goals in plain English, or use the /hunt scaffold and cbh CLI for structured engagement orchestration.

Who it’s for

Security researchers, bug bounty hunters, and authorized red-team operators who use Claude Code or similar agentic harnesses (OpenCode, Codex CLI, Hermes Agent) to conduct external attack surface assessments.

Highlights

• Extensive Knowledge Base: 83 skills covering 24 core vulnerability classes and enterprise identity/infrastructure attack matrices.
• Burp MCP Integration: Ability to wire the Burp MCP server into the agent's environment.
• Multi-Harness Support: Compatible with Claude Code, OpenCode, Codex CLI, and Hermes Agent.
• Deterministic Engagement Engine: A system that maps a target's attack surface and routes findings to the appropriate skill.
• Strict Scope Enforcement: Built-in validation gates to ensure assets are in-scope and authorized before submission.