Web3 bug bounty hunting skills
A skill set for smart contract auditing: bug classes, grep patterns, Foundry PoCs and an Immunefi report format.
- 185 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The material covers vulnerability hunting and exploitation techniques, which must not hit third-party systems without permission.
- PoC templates take addresses and networks, and a wrong address may touch someone else's contract.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/web3-bug-bounty-hunting-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The material covers vulnerability hunting and exploitation techniques, which must not hit third-party systems without permission.
- PoC templates take addresses and networks, and a wrong address may touch someone else's contract.
This is third-party code. Review the repository files before installing.
What it does
The skills load a smart contract vulnerability knowledge base into Claude Code. The author built it from Immunefi reports and DeFi hack reproductions and arranged it into files the agent reads in order. It covers a ten-point target scorecard, ten bug classes with Solidity examples, a set of grep patterns and 18 Foundry PoC templates. Separate files cover validating a finding before submission, the Immunefi report format and walkthroughs of real hunts. The Solidity audit file wires Slither and Aderyn in as an MCP server.
Who it is for. Bug bounty hunters and smart contract auditors who work in Claude Code or Cursor and write Foundry PoCs.
Good fit when
- A hunter scores a new protocol on the target scorecard before spending time on an audit.
- The agent sweeps code with grep patterns for one bug class, such as ERC4626 or signature replay.
- A finding becomes a Foundry PoC from a ready template with an address and `forge test`.
- Before submission a finding goes through the seven-question check and becomes a report.
Not a fit when
- The contract belongs to someone else and no bounty program permits testing it.
- The codebase is not about smart contracts, since the bug classes target Solidity and the EVM.
- The output is meant to be accepted without manual checking, though template PoCs need adapting to the target.
Example request
Read `02-bug-classes.md`, review the vault contract for share accounting errors, then build a Foundry PoC.Limitations
These are knowledge and templates rather than a scanner: the agent output on a contract needs manual verification, and PoCs need tuning to a specific address and version. The README rests on 2,749 Immunefi reports and 681 DeFiHack reproductions, but the figures come from the author. Files are read in order, with the README leading through them from `00-START-HERE.md`. Some material covers offensive techniques, so apply it only to bounty-program targets or your own code. The September 21, 2026 commit was the latest at review time.
How to disable. Delete the `.claude/skills/web3` folder from the project or stop asking the agent to read these files.
FAQ
Where do I start reading?
With `00-START-HERE.md`: it acts as the index, and each following file ends with a link to the next. The README says five files cover the basics.
How do I connect Slither and Aderyn?
The Solidity audit file describes an MCP server that runs Slither, Aderyn and SWC checks inside Claude Code. Take the setup from that file.
Which agents fit?
The README names Claude Code, Claude.ai, Cursor and any AI that reads files. The main flow is built around Claude Code.
How many bug classes does the set cover?
Ten: accounting, access control, incomplete path, off-by-one, price oracles, ERC4626 vaults, reentrancy, flash loans, signature replay and proxies.
Is it fine for third-party projects without permission?
No. The material serves bounty programs and your own code, and testing third-party systems without permission is not acceptable.
Discussion
No questions or reviews yet.
Related
SkillsA plugin marketplace for Claude Code: triage of EVM smart contract vulnerability reports, PoC grading and fix verification.
A skill and command bundle for authorized bug bounty and external red-team work in Claude Code: methodology, chain templates and reports
A set of skills for external OSINT recon: methodology, tactical arsenal and deep attack-surface analysis for authorized assessments
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
Trail of Bits skills
Trail of Bits Skills Marketplace
Trail of Bits plugin marketplace for security work: smart contracts, C/C++ and Rust review, Semgrep, CodeQL and fuzzing
An agentic web scanner: terminal workspace, six stages from recon to report, browser validation of findings, REST and MCP
README in short
The README lists the skill files with their contents, ten bug classes and three setup options. At the bottom it links to related repositories by the author.