Skill 与 AgentSKILLS & AGENTS· CLAUDE-SKILL
awarexone/Agentic-Bug-Hunter
AI-powered bug bounty hunting toolkit that works with or without subscription.
根据公开文档整理，未运行实测；费用以项目官网为准。Based on public documentation, without runtime testing. Check the project site for pricing.
能力CAPABILITIES
上手GET STARTED
uv tool install agentic-bug-hunter # install the CLI (or: pipx install agentic-bug-hunter)选择与你的环境对应的方式。命令来自项目文档，未运行实测。Choose the option for your environment. Commands come from project documentation and have not been run-tested.
使用限制LIMITATIONS
以下要求与风险来自文档静态检查，未执行项目代码；扫描没有命中，不代表使用安全。Risk here is evidence, not an alarm. These findings come from static scanning of the docs; we never execute a project’s code.
限制LIMITS
存在风险Risk found
静态扫描STATIC SCAN
01执行远程脚本Runs a remote scriptreadme
curl -fsSL https://ollama.ai/install.sh | sh
02下载未知二进制Downloads an unknown binaryreadme
chmod +x install_tools.sh && ./install_tools.sh # subfinder · httpx · nuclei · katana · ffuf
03需要系统权限Needs system permissionsskills/bug-bounty/SKILL.md
3. **Self-hosted runner escalation** — If `runs-on:` contains `self-hosted`, check: (a) Is the runner ephemeral? (`--ephemeral` in config.sh
04执行远程脚本Runs a remote scriptskills/cicd-security/SKILL.md
- Dangerous patterns (`eval`, `curl | bash`, etc.)
05执行 Shell 命令Runs shell commandsSKILL.md
grep -rn "eval(\|innerHTML\|dangerouslySetInner\|execSync" --include="*.ts" --include="*.js" | grep -v node_modules
06读取 API KeyReads an API keyskills/agentic-app-audit/SKILL.md
The agent holds credentials/scope the user doesn't. Get it to use those credentials for an action the user is not authorized to perform (rea
07执行 Shell 命令Runs shell commandsskills/bug-bounty/SKILL.md
grep -rn "eval(\|innerHTML\|dangerouslySetInner\|execSync" --include="*.ts" --include="*.js" | grep -v node_modules
08控制浏览器Controls a browserskills/client-reverse/SKILL.md
- **Headless bridge.** Drive a real browser (Selenium/Playwright) to mint the token, hand it to your Python fuzzer. Standard tooling, no SDK
项目动态PROJECT ACTIVITY
首次发现FIRST SEEN
26 OCT 202626 OCT 2026
状态STATUS
持续活跃Active
{
"agents": [
{
"agent": "claude-code",
"evidence": "tree: .claude/"
},
{
"agent": "claude-ai",
"evidence": "readme: …oads\"></a> <a href=\"https://claude.ai/claude-code\"><img src=\"https:…"
},
{
"agent": "opencode",
"evidence": "readme: …ller also supports `claude`, `opencode`, `pi`, `codex`, `agents`, an…"
},
{
"agent": "vscode",
"evidence": "skills/bb-methodology/SKILL.md: …de | Download -> `jsluice` -> VS Code/Cursor grep | Extract -> stat…"
},
{
"agent": "cline",
"evidence": "skills/bug-bounty/SKILL.md: …EASE_TOKEN stolen → malicious Cline v2.3.0 published for 8 hours.…"
},
{
"agent": "gemini-cli",
"evidence": "skills/bug-bounty/SKILL.md: …e question:** Is an AI agent (Gemini CLI, Claude Code, Cline, Codex) i…"
}
],
"apiKey": "(selected explicitly or when `LITELLM_API_KEY` is set) so it never preempts a provide",
"docker": null,
"taxonomy": {
"scores": {
"design": 0,
"ai-tools": 0,
"dev-tools": 1,
"indie-web": 0,
"skill-agent": 6,
"productivity": 0
},
"primary": "skill-agent",
"secondary": "claude-skill"
},
"localRuntime": "# choose your AI provider (Ollama is free + offline) bughunter recon targ",
"skillMdTotal": 20,
"skillMdErrors": [],
"treeTruncated": false,
"categoryScores": {
"data": 0,
"agent": 7,
"media": 0,
"design": 0,
"browser": 0,
"devtool": 5,
"security": 10,
"marketing": 1,
"productivity": 0
},
"classification": [
{
"signal": "20 SKILL.md with name + description",
"weight": 0.95
},
{
"signal": "python dependency on mcp / fastmcp + MCP framing",
"weight": 0.8
},
{
"signal": "skills/ directory with 22 markdown files",
"weight": 0.75
},
{
"signal": "README describes a Claude / Agent Skill",
"weight": 0.7
},
{
"signal": "Claude Code plugin manifest",
"weight": 0.7
},
{
"signal": "description mentions AI",
"weight": 0.2
}
],
"scannedSources": [
"readme",
"SKILL.md",
"skills/agentic-app-audit/SKILL.md",
"skills/argus/SKILL.md",
"skills/bb-methodology/SKILL.md",
"skills/bug-bounty/SKILL.md",
"skills/cicd-security/SKILL.md",
"skills/client-reverse/SKILL.md",
"skills/cloud-pentest/SKILL.md",
"skills/credential-attack/SKILL.md",
"skills/graphql-audit/SKILL.md",
"skills/llm-redteam/SKILL.md",
"skills/mcp-server-audit/SKILL.md",
"skills/meme-coin-audit/SKILL.md",
"skills/mobile-pentest/SKILL.md",
"skills/report-writing/SKILL.md",
"skills/security-arsenal/SKILL.md",
"skills/triage-validation/SKILL.md",
"skills/web2-recon/SKILL.md",
"skills/web2-vuln-classes/SKILL.md",
"skills/web3-audit/SKILL.md"
],
"skillMdFetched": 20
}