elementalsouls/Claude-BugHunter is a self-contained Agent Skills bundle that teaches coding agents bug-hunting methodology — not generic "you are a hacker" prompts. It ships 83 skills, 15 slash commands, and 681 disclosed-report patterns mapped into 24 vulnerability classes, with explicit in-scope and out-of-scope lists so builders know what it will and will not automate.
The repository gained ~124 GitHub stars in a day and sits near 5,900 stars total. It matters because agent-assisted offensive security is now default curiosity for Claude Code users — and because unauthorized use gets both legal and platform-policy risk.
TL;DR: install, scope, and safeguards #
| Topic | Detail ( [README](https://github.com/elementalsouls/Claude-BugHunter?ref=explainx) ) |
|---|---|
| Author | Sachin Sharma / ElementalSoul — bug hunting & GenAI security research |
| Plugin install | /plugin marketplace add elementalsouls/Claude-BugHunter →/plugin install claude-bughunter@elementalsouls |
| Copy install | git clone +bash scripts/install.sh (add--all for multi-harness) |
| In scope | Web apps, APIs, OAuth, SSRF, IDOR, external M365/Okta/vCenter/VPN chains, cloud IAM misconfigs |
| Out of scope | Internal AD attacks, C2 frameworks, persistence, AMSI bypass, iOS/kernel/binary pwn |
| Anthropic policy | CVP enrollment for authorized offensive work; Opus 5 may fall back on some cyber tasks |
| Optional tooling | Burp MCP wiring via install flags |
Agents that act on your behalf need rules. See how explainx helps secure your agents →
What is inside the bundle #
Four layers stack in the README's architecture:
- Think —
bb-methodologyandredteam-mindsetfor non-linear recon → hunt → validate → report flows. - Hunt webapps — 58
hunt-*skills with payloads, bypass tables, and chain templates derived from disclosed bounty reports. - Hit the perimeter — enterprise skills for M365/Entra, Okta, SharePoint ToolShell-era chains, VMware vCenter, SSL VPN appliances, APK pipelines, and supply-chain recon.
- Ship it —
triage-validation, reporting skills, andevidence-hygienewith a7-Question Gate before submission.
Skills load by topic, not by name — you describe the engagement in plain language and the harness pulls the right hunt-* module. That matches how Agent Skills are supposed to behave, but the content here is far denser than a typical coding skill.
Security risk icon representing guardrails for authorized bug bounty agent testing
Install paths: plugin vs copy #
Option A (plugin) keeps skills namespaced under claude-bughunter: and updates with plugin bumps — best if you live in Claude Code daily.
Option B (copy install) drops files into ~/.claude/skills and enables the hunt engagement scaffolder plus optional cbh CLI (pipx install git+https://github.com/elementalsouls/Claude-BugHunter).
The README's comparison table is honest: plugin users get skills fast but need a separate step for cbh; copy install bundles the engagement engine.
Multi-harness support copies the same SKILL.md files into Codex, Hermes, and Antigravity paths when you pass --all. Slash commands remain Claude-Code-only by design.
Authorization and platform friction #
The README's Authorization section is not boilerplate. It states skills target assets you own or have written permission to test, and points to triage-validation questions on program scope and accepted impact.
Separately, Anthropic runtime safeguards can refuse vulnerability-exploitation requests even when your contract is legitimate. The README links the Cyber Verification Program and documents Opus 5 model fallback to Opus 4.8 on some higher-risk cyber classes — easy to miss mid-session.
For defensive work on code you own, the README suggests framing tasks as remediation reviews ("check against OWASP Top 10") rather than disguising live offensive engagements to bypass classifiers — and recommends CVP when the work is genuinely offensive.
How to protect yourself and your program #
Whether you are a researcher or a platform owner, agent-driven hunting changes volume and speed of probes:
- Researchers: keep program rules in-repo (
scope.md), run the 7-Question Gate before filing, and redact PII in screenshots (evidence-hygiene). - Defenders: assume agents will chain OAuth, SSRF, and IDOR templates faster — monitor for burst scanning from residential IPs used as agent sandboxes.
- Agent operators: scope MCP tools (Burp, terminal) so a skill cannot exfiltrate unrelated projects.
For teams building defensive agent controls, review AgentBeam alongside skill installs — it focuses on stopping agents before dangerous actions, complementary to offensive skill packs you only run in authorized labs. Cybersecurity zero-day motif for external-surface bug hunting workflows
Relationship to Claude-OSINT and upstream credits #
The README positions Claude-OSINT as a sister project for recon phases, with two skills canonically maintained in BugHunter and re-exported. Installing both is safe: installers track manifests and skip duplicate copies.
Eight skills vend from shuvonsec/claude-bug-bounty; generators scaffolded additional hunt-* classes. Credits and NOTICE files document upstream obligations — read them if you fork.
Comparison with generic security skills #
| Bundle | Focus | Best for |
|---|---|---|
| Claude BugHunter | External bounty + enterprise perimeter | Authorized H1/Bugcrowd workflows |
| Trail of Bits skills | Secure development patterns | Code review hardening |
| Chrome DevTools MCP | Live browser debugging | Front-end bug reproduction |
BugHunter is not a replacement for human judgment on novel logic bugs; it encodes patterns triagers already paid for on public programs.
Enterprise perimeter skills in more detail #
The README's enterprise platform row is where BugHunter diverges from generic OWASP cheat sheets. Skills such as m365-entra-attack, okta-attack, hunt-sharepoint, vmware-vcenter-attack, and enterprise-vpn-attack encode 2024–2026 CVE chains and appliance-specific quirks — Cisco, Fortinet, Citrix, Palo Alto, Pulse, SonicWall, F5 — that change faster than printed books.
That matters because agent-assisted recon can parallelize identity-fabric mapping (Entra, Okta) with SSL VPN fingerprinting in one session. The bundle's offensive-osint and web2-recon skills feed the ranked surface list shown in the README quickstart transcript (api.acme.com with GraphQL introspection flagged first). None of this replaces program rules; it compresses what a senior hunter would prioritize on hour one.
For readers tracking Microsoft-specific agent abuse, pair BugHunter installs with our ChatMate Copilot CVE coverage — defensive teams need both offensive skill awareness and patch status.
The 7-Question Gate and evidence hygiene #
triage-validation is the bundle's brakes. The README describes a 7-Question Gate before submission: scope, impact class, reproducibility, and related program-policy checks. Combined with evidence-hygiene, it nudges researchers away from screenshots that leak session cookies or victim PII — failure modes that get reports closed as informative even when the bug is real.
Red-team deliverables use redteam-report-template instead of HackerOne markdown, reflecting longer client-facing write-ups with embedded media. If you only ever filed bugs via web forms, read bugcrowd-reporting for VRT-aware severity language — auto-downgrades are a common frustration the bundle tries to preempt.
Slash commands and the /hunt engine #
Fifteen slash commands (/hunt, /recon, /report, …) stay Claude-Code-first even when skills copy to Codex. The engine/ folder maps target surfaces to skills deterministically — useful when you want repeatability across engagements. Plugin installs namespace commands under claude-bughunter: so they do not collide with other security plugins.
The optional cbh CLI (pipx install git+https://github.com/elementalsouls/Claude-BugHunter) runs recon → classify → triage → report outside Claude's UI. Plugin-only users add it separately; copy-install users get scaffolding from the clone.
Training platforms and safe practice #
The README explicitly lists DVWA, OWASP Juice Shop, Hacker101, testphp.vulnweb.com as environments the bundle was exercised against. Those are the right places to learn skill behavior before touching paying programs — not your employer's production tenant.
Anthropic's safeguards note remains critical: even on Juice Shop, model refusals can interrupt chains until you enroll in CVP or frame work as defensive review on repos you own.
What builders should verify before first run #
- Written scope for the target hostname set.
- CVP status if you expect Claude to generate PoCs on live systems.
- Burp MCP credentials isolated from production browser profiles.
- Out-of-scope clarity — do not expect AD or C2 skills; they are intentionally absent.
Related reading #
- [Claude Code commands reference](https://explainx.ai/blog/claude-code-commands-complete-reference-guide-2026) — harness basics
- [ChatMate M365 copilot CVE](https://explainx.ai/blog/chatmate-remote-prompt-execution-m365-copilot-cve-2026-32193-2026) — why enterprise chains matter
- [Cursor Fireworks incident](https://explainx.ai/blog/cursor-fireworks-security-incident-agent-traces-november-2026) — agent trace leakage lessons
- [NVIDIA SkillEvaluator](https://explainx.ai/blog/nvidia-skillevaluator-agent-skills-three-tier-cli-guide-2026) — test skills before you ship them
- [Jane Street Socratic tutor skills](https://explainx.ai/blog/janestreet-agent-skills-socratic-tutor-github-2026) — another specialized skill bundle pattern
Official sources: elementalsouls/Claude-BugHunter README · Anthropic CVP form · Agent Skills spec
Roadmap items that affect install choices #
The README roadmap mentions HackerOne MCP integration (Burp MCP is wired today), per-engagement memory, and quarterly refreshes of enterprise VPN CVE matrices. If you need H1 API automation inside the agent, plan on Burp or manual exports until that milestone ships. hunt-fintech-graphql already exists; healthcare and government compliance hunt skills remain open roadmap entries — do not assume coverage you cannot find in docs/skills.md.
Sponsors ApiSmart and ThreatWatch360 appear in the README footer; they do not change the MIT license but explain ongoing maintenance bandwidth for an 83-skill bundle.
Vendored foundation and NOTICE obligations #
Eight skills come from shuvonsec/claude-bug-bounty under the NOTICE file rules; the generator public-skills-builder scaffolded the per-class hunt-* skills from disclosed patterns. Forking the bundle for internal use means carrying those attributions forward — legal teams care even when engineers only copy SKILL.md fragments. The README credits Trail of Bits and SecSkills as authoring inspirations without vendoring their trees — useful pointers if you want stricter secure-development skills alongside BugHunter's offensive set.
Felony Bench and agent misuse context #
Offensive skill packs sit on the other side of the same coin as agent misuse incidents explainx.ai tracks on /felony-bench. BugHunter is for authorized testing; publishing exploit chains against live targets without scope is how builders land in those incident timelines. Keep engagement letters and program URLs in the repo next to skills so auditors can reconstruct intent.
Skill counts and scope boundaries reflect the main-branch README as of November 15, 2026.