shuvonsec

Claude Bug Bounty — Plugin Guide

Development community intermediate

SOURCE https://github.com/shuvonsec/claude-bug-bounty

Description

This repo is a Claude Code plugin for professional bug bounty hunting across HackerOne, Bugcrowd, Intigriti, and Immunefi.

Installation

This entry records only its repository, not the path inside it, so there is no exact command to give. Open the source below and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

Repository README

This is the README for shuvonsec/claude-bug-bounty, shared by 16 entries in this directory. It describes the repository, not this entry specifically.

Claude Bug Bounty — Plugin Guide

This repo is a Claude Code plugin for professional bug bounty hunting across HackerOne, Bugcrowd, Intigriti, and Immunefi.

What's Here

Skills (7 domains — load with `/bug-bounty`, `/web2-recon`, etc.)

Skill	Domain
`skills/bug-bounty/`	Master workflow — recon to report, all vuln classes, LLM testing, chains
`skills/web2-recon/`	Subdomain enum, live host discovery, URL crawling, nuclei
`skills/web2-vuln-classes/`	18 bug classes with bypass tables (SSRF, open redirect, file upload, Agentic AI)
`skills/security-arsenal/`	Payloads, bypass tables, gf patterns, always-rejected list
`skills/web3-audit/`	10 smart contract bug classes, Foundry PoC template, pre-dive kill signals
`skills/report-writing/`	H1/Bugcrowd/Intigriti/Immunefi report templates, CVSS 3.1, human tone
`skills/triage-validation/`	7-Question Gate, 4 gates, never-submit list, conditionally valid table

Commands (8 slash commands)

Command	Usage
`/recon`	`/recon target.com` — full recon pipeline
`/hunt`	`/hunt target.com` — start hunting
`/validate`	`/validate` — run 7-Question Gate on current finding
`/report`	`/report` — write submission-ready report
`/chain`	`/chain` — build A→B→C exploit chain
`/scope`	`/scope` — verify asset is in scope
`/triage`	`/triage` — quick 7-Question Gate
`/web3-audit`	`/web3-audit` — smart contract audit

Agents (5 specialized agents)

recon-agent — subdomain enum + live host discovery
report-writer — generates H1/Bugcrowd/Immunefi reports
validator — 4-gate checklist on a finding
web3-auditor — smart contract bug class analysis
chain-builder — builds A→B→C exploit chains

Rules (always active)

rules/hunting.md — 17 critical hunting rules
rules/reporting.md — report quality rules

Tools (Python/shell — run directly)

Located in repo root:

hunt.py — master orchestrator
recon_engine.sh — subdomain + URL discovery
validate.py — 4-gate finding validator
report_generator.py — report writer
learn.py — CVE + disclosure intel

Start Here

claude
# /recon target.com
# /hunt target.com
# /validate   (after finding something)
# /report     (after validation passes)

Install Skills

chmod +x install.sh && ./install.sh

Critical Rules (Always Active)

READ FULL SCOPE before touching any asset
NEVER hunt theoretical bugs — "Can attacker do this RIGHT NOW?"
Run 7-Question Gate BEFORE writing any report
KILL weak findings fast — N/A hurts your validity ratio
5-minute rule — nothing after 5 min = move on