Security Bounty Hunter

This is for when you're actually submitting bounty reports, not running a general security audit. It filters out the noise that platforms reject anyway: local-only deserialization, hardcoded shell commands, self-XSS, test files. Instead it focuses on remotely reachable paths like SSRF, auth bypass, SQL injection, and command injection where you can prove user input hits a dangerous sink. The workflow is practical: check scope first, find real entrypoints, trace the code path end to end, then build a minimal PoC. It includes a quality gate checklist and report template so you're not wasting time on duplicates or out-of-scope findings. Use this when the question is "will this pay?" not "is this theoretically unsafe?"

skills.sh installs: 3.7K
GitHub stars: 229.1K
last updated: Jul 14, 2026

View on GitHub

Install

$ npx -y skills add affaan-m/everything-claude-code --skill security-bounty-hunter --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Bounty Hunter

Use this when the goal is practical vulnerability discovery for responsible disclosure or bounty submission, not a broad best-practices review.

When to Use

Scanning a repository for exploitable vulnerabilities
Preparing a Huntr, HackerOne, or similar bounty submission
Triage where the question is "does this actually pay?" rather than "is this theoretically unsafe?"