Bug Bounty

Bug Bounty is a Quality skill for Claude Code, published by shuvonsec in claude-bug-bounty.

4.2K stars767 forkson shuvonsec/claude-bug-bountyAdded 2026/08/16+1% in starsRepository updated 2026/08/10

ai-securitybug-bountybugcrowdclaude-aiclaude-codectiethical-hackinghackeronehackinghacking-toolpenetration-testingreconvulnerability-scanner

Install in seconds

Install Bug Bounty

Copy Bug Bounty into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.

terminal

npx degit https://github.com/shuvonsec/claude-bug-bounty/tree/main/skills/bug-bounty ~/.claude/skills/bug-bounty

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/shuvonsec/claude-bug-bounty.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file: skills/bug-bounty/SKILL.md in shuvonsec/claude-bug-bounty
Installs to: ~/.claude/skills/bug-bounty
Collection: One of 16 skills cataloged from this repository
Category: Quality — 1354 skills

What Bug Bounty does

Bug Bounty provides a complete bug bounty workflow covering reconnaissance, vulnerability hunting, AI/LLM security testing, bug chaining, and report writing. Use it for starting new targets, hunting specific vuln classes, auditing source code, validating findings, or writing reports.

Bug Bounty is cataloged under Quality on DirSkills. Bug Bounty comes from a repository tagged ai-security, bug-bounty, bugcrowd, claude-ai and claude-code.

Documentation

README

Excerpt

Bug Bounty Master Workflow

Full pipeline: Recon -> Learn -> Hunt -> Validate -> Report. One skill for everything.

THE ONLY QUESTION THAT MATTERS

"Can an attacker do this RIGHT NOW against a real user who has taken NO unusual actions -- and does it cause real harm (stolen money, leaked PII, account takeover, code execution)?"

If the answer is NO -- STOP. Do not write. Do not explore further. Move on.

Theoretical Bug = Wasted Time. Kill These Immediately:

This is the opening of the README. Read the full README on GitHub.

Commands Bug Bounty provides

Slash commands named in this skill’s SKILL.md, listed in the order they first appear.

/horizon
/telescope
/xmlrpc
/graphql

Frequently asked about Bug Bounty

What else does shuvonsec publish alongside Bug Bounty?
Bug Bounty is one of 16 skills that DirSkills catalogs from shuvonsec/claude-bug-bounty, the repository it ships in. Its siblings there include Argus, Bug Bounty and Bug Bounty Methodology. Each one is a separate skill with its own page in this directory, installs the same way Bug Bounty does, and is maintained by shuvonsec in that same repository. The rest of the collection is listed on the shuvonsec/claude-bug-bounty page.
How does Bug Bounty compare to other Quality skills?
Bug Bounty ranks #331 by stars among the 1354 Quality skills in this catalog. The most-starred ones next to it are Benchmark, Benchmark Optimization Loop and API Design Patterns. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of Bug Bounty against them. Open each page to compare what they document and how they install.