--- name: bug-bounty description: Complete bug bounty workflow category: security risk: offensive source: https://github.com/elementalsouls/Claude-BugHunter source_repo: elementalsouls/Claude-BugHunter source_type: community date_added: '2026-09-20' license: MIT license_source: https://github.com/elementalsouls/Claude-BugHunter/blob/main/LICENSE compatibility: Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled. sources: community, public_research --- > **⚠️ AUTHORIZED USE ONLY** > This skill is for educational purposes or authorized security assessments only. > You must have explicit, written permission from the system owner before using this tool. > Misuse of this tool is illegal and strictly prohibited. > **Mandatory confirmation gate** > Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target: > 1. Ask the user to state the exact target URL, IP, account, or resource. > 2. Ask the user to confirm written authorization and the permitted scope. > 3. Show the exact command(s) and explain their expected effect. > 4. Wait for explicit confirmation in the current conversation. > > Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab. # Bug bounty review workflow ## When to Use Use for an explicitly authorized bug-bounty engagement, scoped source review or lab reproduction. This skill organizes evidence and reporting; it does not grant permission to test every asset owned by an organization or any discovered host. The mandatory confirmation gate above applies to each active command. ## Scope and plan Record the program policy URL and retrieval time, exact allowed assets/accounts, allowed techniques, exclusions, rate/concurrency limits, test window, data-handling rules and stop conditions. Ownership is not authorization. Resolve ambiguous scope with the program before testing. Do not pivot into third-party services, metadata, CI runners or unrelated accounts because a vulnerability appears to permit it. Begin with already authorized local source, architecture and documented public material. Check authentication, object/tenant authorization, input handling, workflow state, cache boundaries and dependency provenance. Treat scanner output, fingerprints, secret-pattern matches and CVE-version matches as leads. ## Validate with minimum impact Use synthetic records and two accounts controlled by the engagement. Request approval for an exact bounded test with expected effect and rollback. Demonstrate the smallest effect sufficient to establish the security boundary failure; stop when evidence is adequate. Never require stolen money, real-user PII, production credential use, persistence or a destructive exploit as a prerequisite for reporting. A source-proven issue can be reported with its runtime uncertainty clearly stated. Conditions, authentication and user interaction do not invalidate a vulnerability. Separate confirmed behavior, inferred impact and untested hypotheses. Do not apply an “always rejected” list across programs; eligibility and payout are program policy, while risk and remediation may remain relevant even without a bounty. Timeboxes guide prioritization, not proof that a host is safe after five minutes. ## Example: static first step ```text Evidence record: - Scope: approved local checkout at full commit SHA - Observation: route reads object ID from user input - Expected boundary: caller must belong to the object's tenant - Current evidence: missing authorization in this code path - Untested: deployed reachability and compensating middleware - Proposed test: two controlled accounts and one synthetic object, pending approval ``` Store source/version, timestamps, redacted requests, role/tenant and expected vs actual result. Keep evidence private with restricted retention. Discovery of a credential requires immediate stop, redaction and owner notification through the approved channel, not testing the credential against production services. ## Report and handoff Use [detailed evidence guidance](references/details.md). Include prerequisites, exact affected version/location, safe reproduction, evidence, bounded impact, remaining uncertainty and remediation. Calculate the full CVSS vector using the program's requested version; do not assign severity from vulnerability name alone. Return a draft unless submission/public disclosure is explicitly authorized. ## Limitations and provenance This is a docs-only adaptation of [elementalsouls/Claude-BugHunter](https://github.com/elementalsouls/Claude-BugHunter), with declared upstream MIT attribution retained. No external tools, helper engine, slash command or engagement scaffold is bundled. Verify separately installed skills and prerequisites before routing to them. Do not fetch moving branches or install tools from historical snippets; a separately authorized installation must pin and inspect artifacts before activation. No historical payout, “top 1%”, zero-misfire or live-test certification is established by this local tree. --- Source attribution: elementalsouls/Claude-BugHunter contributors, via Agentic Awesome Skills Original project: https://github.com/elementalsouls/Claude-BugHunter License: MIT + CC-BY-4.0 License information: https://creativecommons.org/licenses/by/4.0/ Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2026 Sachin Sharma Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: elementalsouls/Claude-BugHunter contributors, via Agentic Awesome Skills Original project: https://github.com/elementalsouls/Claude-BugHunter Attribution basis: Recorded upstream repository Fields of work: Development & Engineering Roles: Security Engineer Specialties: Specialty not specified Tools: Tool not specified Country applicability: Country not specified Classification basis: Dave AI task classification from package title, description, and declared metadata Instruction SHA-256: b182dacb3d4459e45e44f608535546cbab77b2ea83e294571af2cc2de3f060fc Metadata reviewed: 2026-10-27 This metadata supersedes earlier Mega AI Hub catalog attribution. Original instruction and supporting files are preserved.