Bug Hunting

Bug bounty hunting and penetration testing skills for Claude, Codex, and other agentic AI tools.

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add m4vic/bug-hunting --skill bug-hunting

Manual install

git clone --depth 1 https://github.com/m4vic/bug-hunting.git /tmp/bug-hunting
mkdir -p ~/.claude/skills
cp -r /tmp/bug-hunting/. ~/.claude/skills/bug-hunting

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Bug Hunting — Router

This is the entry point only. It does not contain technique detail — it decides which domain guide to load, then gets out of the way. Loading this file should never cost more than a few hundred tokens.

## The core discipline

Real bug hunting is not "run the checklist for one vuln class." Nobody tells you what bug exists, or if one exists at all. The loop is:

1. **Map the surface completely** — every endpoint, param, auth state, response shape.
2. **Hypothesize widely** — for each input, ask "what could this become?" Don't commit to one guess. A URL-fetching param could be SSRF, or IDOR if that value doubles as a record key — keep both alive until evidence rules one out.
3. **Confirm, don't guess** — a finding is only real once you've proven it (differential response, out-of-band callback, reproduced twice). Report only what you proved.

## Step 0 — the operating workflow (mandatory, before any domain routing)

Read the full skill on GitHub

Details

Skill name: bug-hunting
Repository: m4vic/bug-hunting
License: MIT
Repo updated: 25 August 2026

FAQ

What does the Bug Hunting skill do?

Bug bounty hunting and penetration testing skills for Claude, Codex, and other agentic AI tools.

How do I install the Bug Hunting skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add m4vic/bug-hunting --skill bug-hunting. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Bug Hunting popular?

It lives in m4vic/bug-hunting, which has 14 GitHub stars and 2 forks.

Related skills

Chainaware Behavioral Prediction

ChainAware/behavioral-prediction-mcp

Use this skill whenever a user asks about wallet safety, fraud risk, rug pull detection, wallet behavior analysis, DeFi personalization, on-chain reputation scoring, AML checks, token ranking by holder quality, airdrop screening, lending risk, token launch auditing, or AI agent trust scoring. Triggers on questions like: is this wallet safe?, will this pool rug pull?, what will this address do next?, score this wallet, detect fraud for address, personalize my DeFi agent, rank this token, top AI tokens, best holders of this token, check this contract, is this token safe?, profile this wallet, KY

AI, LLMs & AgentsIn 1 list

AI Advisory Board

evoputa/ai-advisory-board

AI-powered advisory board of 100+ real-world business leaders spanning 18 domains, 4 continents, and balanced gender representation. Each leader speaks in their authentic voice using their documented frameworks and principles. Convenes boardroom sessions with 3-5 relevant advisors, allows disagreement, and delivers a unified synthesis with specific next actions. Supports full board sessions, domain-specific counsel, quick checks, and cross-domain tension resolution. Customizable via company profile configuration. Use when facing strategic decisions, evaluating opportunities, pressure-testing p

AI, LLMs & Agents

Claude Managed Agents

0xArx/claude-managed-agents-skill

Build applications with the Claude Managed Agents API — Anthropic's managed infrastructure for running Claude as an autonomous agent in a cloud container. Trigger this skill whenever the user wants to build with managed agents, asks about agent sessions, wants to stream agent events, uses client.beta.agents / client.beta.sessions / client.beta.environments, asks about the managed-agents-2026-04-01 beta, wants Claude to autonomously run tools in a sandbox, or asks about outcomes, multiagent orchestration, or persistent agent memory. Also trigger when the user asks how to run Claude for long-run

AI, LLMs & Agents

Agent Guardrails

jzOcb/agent-guardrails

Stop AI agents from secretly bypassing your rules. Mechanical enforcement with git hooks, secret detection, deployment verification, and import registries. Born from real production incidents: server crashes, token leaks, code rewrites. Works with Claude Code, Clawdbot, Cursor. Install once, enforce forever.

AI, LLMs & Agents

Decompose

matt-k-wong/mkw-DAG-architect

Learn to decompose complex problems before building real agents. Better answers today. Ready for orchestration tomorrow. Breaks messy tasks into clear DAG structures with explicit dependencies, parallel branches, and synthesis logic. Improves Claude outputs by enforcing topological order and catching contradictions. Teaches the mental model for LangGraph, CrewAI, n8n, and Sub-Agents. Type "decompose: [goal]" or "decompose preview: [goal]" to start. Zero experience required.

AI, LLMs & Agents

Llmapper

jorgearango/llmapper-skill

Generate concept maps from articles (files, URLs, or text) using a multi-stage LLM pipeline (user-chosen focus → summarize → RDF → Mermaid)

AI, LLMs & Agents

Browse the most popular Claude skills, all ai, llms & agents skills, or write your own with the skills generator.