youseefhamdi

Bugwolf — Security skill for Claude Code

Security community

BugWolf — all-round bug bounty hunting skill for Claude Code: parallelized agents for smart contract audits (EVM, Move, Solana, TRON), web/API security, CI/CD attacks, LLM/agentic AI security, and sub.

How to install Bugwolf

This entry records only its repository, not the path inside it, so there is no exact command to give. Open youseefhamdi/bugwolf and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Bugwolf does

Alternatives in Security

/web3 Audit — Smart contract security audit using the 10-bug-class methodology 927 ★
Query Token Audit — Audit token security to detect scams, honeypots, and malicious contracts across BSC, Base, Solana, and Ethereu 483 ★
Bountyforge — All-round bug bounty skill for Claude Code parallelized agents for smart contract audits (EVM, Move, Solana, T 399 ★

README

BugWolf

██████╗ ██╗   ██╗ ██████╗ ██╗    ██╗ ██████╗ ██╗      ███████╗
██╔══██╗██║   ██║██╔════╝ ██║    ██║██╔═══██╗██║      ██╔════╝
██████╔╝██║   ██║██║  ███╗██║ █╗ ██║██║   ██║██║      █████╗
██╔══██╗██║   ██║██║   ██║██║███╗██║██║   ██║██║      ██╔══╝
██████╔╝╚██████╔╝╚██████╔╝╚███╔███╔╝╚██████╔╝███████╗██║
╚═════╝  ╚═════╝  ╚═════╝  ╚══╝╚══╝  ╚═════╝ ╚══════╝╚═╝

██╗  ██╗██╗   ██╗███╗   ██╗████████╗███████╗██████╗
██║  ██║██║   ██║████╗  ██║╚══██╔══╝██╔════╝██╔══██╗
███████║██║   ██║██╔██╗ ██║   ██║   █████╗  ██████╔╝
██╔══██║██║   ██║██║╚██╗██║   ██║   ██╔══╝  ██╔══██╗
██║  ██║╚██████╔╝██║ ╚████║   ██║   ███████╗██║  ██║
╚═╝  ╚═╝ ╚═════╝ ╚═╝  ╚═══╝   ╚═╝   ╚══════╝╚═╝  ╚═╝

All-round authorized security-research skill for Claude Code and Freebuff — parallelized agents for smart contract audits (EVM, Move, Solana, TRON), web/API security, local tooling orchestration, and submission-ready reports for HackerOne, Bugcrowd, Intigriti & Immunefi.

**AI Pentesting Tool:** Run isolated, cloud-hosted pentesting sandboxes at **[bugwolf.xyz](https://bugwolf.xyz)** — your AI key, your Firecracker microVM, your report. Pipeline: recon → hunt → triage → H1-ready report. AI slop gets you rate-limited; BugWolf gets you paid.

**New in v1.0.0:** LLM / Agentic AI security track (OWASP GenAI LLM Top 10 2026 + Agentic Top 10 ASI01–ASI10), RAG & embedding attacks, MCP security, mobile + cloud-native vectors, and a zero-day LLM attack-surface detector. See [CHANGELOG.md](CHANGELOG.md).

**Operating mode:** Production campaigns run only from an operator-supplied target specification and attestation. The operator defines the exact boundary and Rules of Engagement; BugWolf records that provenance and applies maximum capability inside it. Local fixtures (VulnBank, Anvil, LocalStack, and stubs) validate the pipeline only; they are not the production boundary.