Bugbountyrules

Use for ANY bug bounty, penetration test, or web/API/mobile security assessment: recon, testing endpoints, analyzing Burp traffic or any bug-bounty platform's MCP (HackerOne, Intigriti, Bugcrowd, YesWeHack, Immunefi), reviewing APKs, bypassing a WAF, enforcing scope, hunting a specific vuln class, validating findings, writing reports, or when you are stuck on a target and about to give up. Activates automatically for all bug-bounty and pentest sessions. Runs an autonomous, never-surrender predator methodology: refuses to conclude "secure", exhausts each vuln class to depth, proves a real attac

35 stars 6 forksSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add sanjarbiy/bugbountyrules --skill bugbountyrules

Manual install

git clone --depth 1 https://github.com/sanjarbiy/bugbountyrules.git /tmp/bugbountyrules
mkdir -p ~/.claude/skills
cp -r /tmp/bugbountyrules/. ~/.claude/skills/bugbountyrules

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# THE PREDATOR

**You are starving. The vulnerability is your only food. Make the kill or you don't eat - and a predator that doesn't eat dies.**

This is not a checklist you comply with. It is what you ARE. A hungry lion does not consult 42 rules before it hunts - the rules below are your instincts, and when you are starving they fire without thinking. You have exactly one drive: **find the vulnerability, prove it, feed.** Everything else is noise.

A starving predator:

- **Never stops while prey breathes.** "No bug found" is not a conclusion - it is the growl in your gut. There IS meat on this target; you have not smelled it yet. You stop only when you have fed, or when every trail is provably, verifiably cold - and even then you widen the territory and hunt again. *(Rule 24, 25)*
- **Goes for the throat, and reads the whole body.** You strike where the kill matters - authentication, money movement, admin, PII, account takeover - and you think in SYSTEMS, not endpoints: you follow request FLOWS across the app, not isolated requests, because the wound is in how the pieces connect. Low-value noise is not food. *(Rule 3.6, 4, 20)*

Read the full skill on GitHub

Details

Skill name: bugbountyrules
Repository: sanjarbiy/bugbountyrules
License: MIT
Repo updated: 18 August 2026

FAQ

What does the Bugbountyrules skill do?

How do I install the Bugbountyrules skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add sanjarbiy/bugbountyrules --skill bugbountyrules. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Bugbountyrules popular?

It lives in sanjarbiy/bugbountyrules, which has 35 GitHub stars and 6 forks.

Related skills

R00 Alirezarezvani Claude Skills Security

Axisfrommall/r02-alirezarezvani-claude-skills-security

🔒 Security & Compliance skill suite derived from alirezarezvani/claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

Security

R00 Travisvn Awesome Claude Skills Security

regimentpebblehearth/r09-travisvn-awesome-claude-skills-security

🔒 Security & Compliance skill suite derived from travisvn/awesome-claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

Security

Repo Security Review

Consensys/repo-security-review

Full automated security review pipeline for a code repository. Use this skill whenever the user asks to: review a repo for security issues, run a security audit, find vulnerabilities in a codebase, perform a security assessment, check for OWASP Top 10 and OWASP API Top 10 issues, scan for secrets or exposed credentials, audit dependencies for CVEs, or analyze architecture for security flaws. Trigger even for casual phrasings like "can you check this repo for security issues" or "run security on this". This skill orchestrates a multi-phase pipeline of isolated subagents: secret scanning, tech-s

Security

R00 ComposioHQ Awesome Claude Skills Security

CraftsmanTuck/r08-composiohq-awesome-claude-skills-security

🔒 Security & Compliance skill suite derived from ComposioHQ/awesome-claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

Security

Specforge

GodModeAI2025/specforge-ai-skill

Spec-Driven Requirements Engineering mit Governance-Enforcement. Kombiniert Harness-Patterns, EARS-Syntax, Gherkin und NIS2/KRITIS-NFRs. Erzeugt spec.md, plan.md, tasks.md und mehr. Verwende diesen Skill IMMER bei: Requirements schreiben, User Stories, Spezifikation erstellen, Spec-Driven Development, EARS, Gherkin, Requirements Review, Stakeholder-Analyse, KRITIS, NIS2, STRIDE, ADR, Clarify, Analyze, Checklist, Research, Quickstart, Discover, Reverse Engineering. Auch bei: "erstelle eine Spezifikation", "was fehlt in diesem Requirement", "simuliere einen Security Officer", "STRIDE-Analyse", "

Security

Security Scan

chaenmasahiro0425/claude-security-scan

開発者のPC・手元のgitリポジトリ・GitHub・Vercelと公開サイト・クラウド（AWS / Google Cloud / Azure / Cloudflare / Supabase）・Gmailを読み取り専用で横断スキャンし、重要度別のHTMLレポートと前回からの差分を出すスキル。「セキュリティチェックして」「セキュリティスキャン」「脆弱性ないか見て」「APIキー漏れてない？」「乗っ取られてないか確認」「新しく出たリスクだけ教えて」「毎週スキャンを設定して」等で使う。設定の変更・送信・削除はしない。直すときは1件ずつ利用者の承認を取る。

Security

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.