Pentest Agents Bug Bounty Framework
This is a complete autonomous bug bounty framework that runs inside Claude Code and other AI coding tools. You get 50 specialized agents for hunting SQLi, XSS, IDOR, and other vulns, plus two MCP servers that pull live program scopes from HackerOne and search through your own indexed writeup corpus. The standout piece is the 7-Question Gate validator that checks if findings are actually exploitable before you waste time writing reports, and a chain builder that links multiple weak findings into serious exploits. It scaffolds entire workspace directories per program with persistent brain tracking for endpoints you've already tested. The cross-IDE installer handles Cursor, Windsurf, Copilot, and others if you're not on Claude Code. Built by ara.so's security team, ships 2,500 lines of actual payloads rather than generic advice.
- skills.sh installs
- 1K
- GitHub stars
- 6
- last updated
- Jul 14, 2026
Install
$ npx -y skills add aradotso/security-skills --skill pentest-agents-bug-bounty-framework --agent claude-codeInstalls into .claude/skills of the current project.
Files
Pentest Agents Bug Bounty Framework
Skill by ara.so — Security Skills collection.
Autonomous bug-bounty framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw. Ships 50 agents, 26 commands, 19 CLI tools, 11 skills, and 2 MCP servers (bounty platforms + writeup search). Includes 2,500 lines of concrete payloads, 7-Question Gate validation, autonomous hunt loops, A→B exploit chain building, persistent brain with endpoint tracking, and cross-IDE installer.
Installation
For Claude Code (Native)
# Clone the repository
git clone https://github.com/H-mmer/pentest-agents-suite
cd pentest-agents-suite/pentest-agents
# Quick start with MCP servers (no global pip install)
export HACKERONE_USERNAME=your_username
export HACKERONE_TOKEN=your_api_token
# Scaffold a new bounty workspace
uv run python3 tools/scaffold.py hackerone tesla
cd ~/bounties/hackerone-tesla
# Launch Claude Code
claude
For Other AI Coding Tools
# Use pre-rendered bundles directly
cd pentest-agents-suite/pentest-agents/providers/codex # or gemini, cursor, etc.
codex # or: gemini, cursor, windsurf
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/aradotso/security-skills
- Categories
- Security, Debugging
- First seen
- Jul 14, 2026
More from aradotso/security-skills
All 58- Openosint Ai Osint Framework992
- Vibe Security Skill976
- Openclaw Security Hardening971
- Malware Detection Awareness960
- Slowmist Agent Security Framework955
- Autopentestx Automated Pentesting950
- Avast Premium Security Analysis947
- Malware Warning Avast Keygen945
- Palisade Security Nexus Bitdefender937
- Malware Warning Avast Piracy934
- Avast Security Awareness933
- Report Malicious Repository927
- Unisecurityguard Academic Whistleblower Archive925
- Wxmini Security Audit919
- Avast Premium Security Detection918
- Security Awareness Malicious Repository Detection909
- Avast Premium Security Malware Analysis905
- Avast Premium Security Awareness898
- Avast Security Analysis897
- Openclaw Security Watchdog856
- Security Threat Awareness852
- Malware Analysis DragonflyTomb Avast851
- Avast Premium Security Malware Detection837
- Mcp Security Hub827
Recommended
More Security
swift-security-expertivan-magda/swift-security-skillUse when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), Crypto875skills.sh installs
security-pen-testingalirezarezvani/claude-skillsUse when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments. Covers s862skills.sh installs
netsuite-owasp-secure-codingoracle/netsuite-suitecloud-sdkPlatform-agnostic OWASP secure coding practices with JavaScript/Node.js patterns and NetSuite SuiteScript examples. Covers Open Worldwide Application Security P838skills.sh installsskill-security-auditoralirezarezvani/claude-skillsSecurity audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skil817skills.sh installs
security-auditorovachiever/droid-tingsContinuous security vulnerability scanning for OWASP Top 10, common vulnerabilities, and insecure patterns. Use when reviewing code, before deployments, or on f781skills.sh installs
oauth-implementationmindrally/skillsGuidelines for implementing OAuth 2.0 and OAuth 2.1 authentication flows with security best practices and PKCE747skills.sh installs