// the find
elementalsouls/Claude-BugHunter
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.
A Claude Code skill bundle that turns Claude into a bug-bounty/external-red-team assistant: ~83 markdown skills covering OWASP-style vuln classes plus enterprise platform attack chains (Entra, Okta, vCenter, SSL-VPN appliances), installable as a plugin or copied into ~/.claude. Aimed at bug hunters and pentesters who already use Claude Code and want pre-baked methodology, payload patterns, and reporting workflows rather than building prompts from scratch.
The scope boundary is unusually disciplined for this genre — it explicitly excludes AD lateral movement, C2 tradecraft, and evasion, and says so in the README instead of quietly creeping into them. There's real engineering scaffolding around what's otherwise a prompt collection: a lint/eval harness, CI checks (skill-lint, leak-guard, doc-count-check), and a `cbh` CLI for engagement orchestration, not just a pile of SKILL.md files. The multi-harness design (same Agent Skills format loading into Claude Code, OpenCode, Codex CLI, etc.) is a sensible, low-effort portability choice since it's just a shared file format.
There's no way to verify the headline numbers — '681 disclosed-report patterns,' 'battle-tested across authorized engagements' — the content is markdown prose generated/summarized from HackerOne reports via a separate 'public-skills-builder' tool, and only 433 of the claimed patterns are individually cited; the rest is an unaudited claim. The star-to-fork ratio (4980/757) alongside a dedicated sponsor section and sponsor logos in the README reads more like a marketed product than organic adoption, which is worth discounting when judging 'popularity' as a quality signal. The dual-license split by file extension (*.py/*.sh MIT, *.md CC BY) is a fragile boundary for a repo that's 90% markdown — easy to violate accidentally in forks or derivative skill packs. Fundamentally this is prompt engineering, not code: there's no way to unit-test whether a 'hunt-ssrf' skill actually improves Claude's bypass success rate beyond the included eval harness's own labs, so claims of effectiveness rest on the maintainer's say-so.