Skills for Real Engineers. Straight from my .agents directory.
39 skills
bb-local-toolkit
Agent skill from
Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, ghauri); for pure orchestration/routing use the bug-bounty skill. Workflow it covers — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaini
How to install bb-local-toolkit
install bb-local-toolkit
# install the Claude-BugHunter pack with the skills CLI
npx skills add elementalsouls/Claude-BugHunter# or add only this skill to Claude Code: copy the folder
skills/bb-local-toolkit/
# into
~/.claude/skills/bb-local-toolkit/ (all projects)
.claude/skills/bb-local-toolkit/ (one project)
1# Bug Bounty Master Workflow23Full pipeline: Recon -> Learn -> Hunt -> Validate -> Report. One skill for everything.45## THE ONLY QUESTION THAT MATTERS67> **"Can an attacker do this RIGHT NOW against a real user who has taken NO unusual actions -- and does it cause real harm (stolen money, leaked PII, account takeover, code execution)?"**8>9> If the answer is NO -- **STOP. Do not write. Do not explore further. Move on.**1011### Theoretical Bug = Wasted Time. Kill These Immediately:1213| Pattern | Kill Reason |14|---|---|15| "Could theoretically allow..." | Not exploitable = not a bug |16| "An attacker with X, Y, Z conditions could..." | Too many preconditions |17| "Wrong implementation but no practical impact" | Wrong but harmless = not a bug |18| Dead code with a bug in it | Not reachable = not a bug |19| Source maps without secrets | No impact |20| SSRF with DNS-only callback | Need data exfil or internal access |21| Open redirect alone | Need ATO or OAuth chain |22| "Could be used in a chain if..." | Build the chain first, THEN report |2324**You must demonstrate actual harm. "Could" is not a bug. Prove it works or drop it.**2526---2728## CRITICAL RULES29301. **READ FULL SCOPE FIRST** -- verify every asset/domain is owned by the target org312. **NO THEORETICAL BUGS** -- "Can an attacker steal funds, leak PII, takeover account, or execute code RIGHT NOW?" If no, STOP.323. **KILL WEAK FINDINGS FAST** -- run the 7-Question Gate BEFORE writing any report33…
Excerpt shown under the repository's MIT license.
More skills in Claude-BugHunter
Keep exploring
Similar skill repositories
An agentic skills framework & software development methodology that works.
15 skills
A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls.
CC1 skill
Public repository for Agent Skills
20 skills
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
CCCU6 skills
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
CCCXGHGM+135 skills