Bug Bounty Hunter — Security skill for Claude Code

Bug Bounty Hunter

All-round bug bounty skill for Claude Code — parallelized agents for smart contract audits (EVM, Move, Solana, TRON), web/API security, and submission-ready reports for HackerOne, Bugcrowd, Intigriti & Immunefi.

---

What It Does

Bug Bounty Hunter spins up **8 specialized security agents in parallel**, each attacking a different surface of your target. Findings are deduplicated, gate-evaluated, CVSS-scored, and formatted into a submission-ready report — in minutes.

Agent	Covers
Web / API	Auth bypass, IDOR, XSS, SSRF, SQLi, GraphQL, CORS
Smart Contract	EVM, Move/Aptos, Solana, TRON — structural & chain-specific bugs
Access Control	Role bypass, init hijack, confused deputy, proxy admin
Business Logic	State machine abuse, workflow skip, limit bypass, payment logic
Crypto / Math	Overflow, precision loss, signature replay, EIP-712, nonce issues
Race Conditions	Front-running, sandwich, TOCTOU, rotation window races
Economic Security	Flash loans, oracle manipulation, inflation attacks, DeFi tokenomics
Recon	Subdomain takeover, secret leaks, cloud misconfig, chain explorer recon

**Supported chains:** Ethereum / EVM · Aptos / Move · Solana / Anchor · TRON

**Report formats:** HackerOne · Bugcrowd · Intigriti · Immunefi · Generic

---

Installation

Claude Code (terminal)

# Download the .skill file from releases, then:
unzip bug-bounty-hunter.skill -d ~/.claude/skills/

Or clone directly:

git clone https://github.com/Jeffreyxdev/bug-bounty-hunter.git ~/.claude/skills/bug-bounty-hunter

Start a fresh Claude Code session — skills load at startup.

Claude.ai (web/app)

1. Go to Customize → Skills
2. Make sure Code execution is enabled in Settings → Capabilities
3. Upload the .skill file

---

Usage

Audit a contract or repo

audit contracts/

run bug bounty hunter on src/usdc.move --platform immunefi --cvss --file-outp