claude-bughunter plugin
A skill and command bundle for authorized bug bounty and external red-team work in Claude Code: methodology, chain templates and reports
- 5,613 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Includes offensive techniques and vulnerability exploitation chains
- Runs recon tools and network commands against targets
- Intended only for authorized testing, with responsibility on the user
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/claude-bughunterDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Includes offensive techniques and vulnerability exploitation chains
- Runs recon tools and network commands against targets
- Intended only for authorized testing, with responsibility on the user
This is third-party code. Review the repository files before installing.
What it does
The bundle turns Claude Code into an assistant for vulnerability hunting and external red-team work. It is built from several layers: a five-phase non-linear methodology and operator discipline, dozens of hunt-* skills by web vulnerability class with detection patterns, payloads, filter-bypass tables and chain templates, plus enterprise perimeter attack chains (M365 and Entra, Okta, vCenter, SSL-VPN, SharePoint, cloud IAM) with current CVE chains. A separate layer handles triage, reporting and evidence hygiene: a seven-question gate before submission, VRT-aware severity, out-of-scope rebuttals and PII redaction. Skills load automatically from a plain-English description of what you are testing. There is Burp integration over MCP, a standalone cbh CLI and an engagement-folder scaffolder. Offensive domains require the target to be in scope and the work to be authorized.
Who it is for. For security professionals: bug hunters, pentesters and red-teamers working within an authorized scope.
Good fit when
- An authorized bug bounty is underway and you need recon and surface prioritization
- You need detection patterns and chains for a specific vulnerability class
- You need to prepare triage and a report with severity assessment
Not a fit when
- You have no written authorization and defined scope
- The target is not yours and not part of a testing program
Example request
I am testing an in-scope HackerOne target, run recon and rank the attack surfaceLimitations
The bundle is intended only for authorized testing, research and education; keeping to scope and staying legal is the user's responsibility. Some features need separate setup: the cbh CLI installs via pipx, the engagement-folder scaffolder ships only with a repo clone, and Burp integration over MCP is wired separately. The slash commands and the hunt engine work only in Claude Code, while the knowledge layer ports to other environments. MIT licensed.
How to disable. Remove the plugin: /plugin uninstall claude-bughunter@elementalsouls. If you installed by copying, remove the skill and command folders from ~/.claude/.
FAQ
Is this legal?
The bundle targets authorized testing within a defined scope. It includes scope checks, out-of-scope assessment and evidence hygiene, but authorization for the target must be yours.
Do I have to install every skill?
The plugin installs all skills and commands under the claude-bughunter prefix. With a copy install you can move only the skill folders you need.
Discussion
No questions or reviews yet.
Related
PluginsAn authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
A pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
Claude Code CyberSecurity Skills
Claude Code CyberSecurity Skill Collection
A set of 22 cybersecurity skills for Claude Code: recon, vulnerability assessment, incident response, red and blue team, malware analysis
A set of skills for external OSINT recon: methodology, tactical arsenal and deep attack-surface analysis for authorized assessments
A Claude Code plugin that helps write bug bounty reports from verified facts only, with nothing invented
A library of offensive security skills for the Claude Skills system: red team methodology across dozens of areas
README in short
The README describes a bundle of dozens of skills and fifteen slash commands that turn Claude Code into a bug-hunting and external red-team assistant. The material is split into layers: methodology and operator mindset, hunt-* skills by vulnerability class based on disclosed HackerOne reports, attack chains against enterprise platforms, and a layer for triage, reporting and evidence hygiene. Installation is as a plugin via the repository marketplace or by copying with install.sh or install.ps1. The SKILL.md format ports across several environments, including Claude Code, OpenCode and Codex CLI. There is Burp integration over MCP, a cbh CLI and an engagement-folder scaffolder. MIT licensed.