RCE Hunter

by H-mmer

RCE Hunter is a Quality skill for Claude Code, published by H-mmer in pentest-agents.

804 stars156 forkson H-mmer/pentest-agentsAdded 2026/08/22Repository updated 2026/06/12

View source on GitHub Download repo ZIP

agentsbug-bountybugcrowdclaude-codehackeronemcppentestingsecurity-tools

Install in seconds

Install RCE Hunter

Copy RCE Hunter into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.

terminal

npx degit https://github.com/H-mmer/pentest-agents/tree/main/skills/hunt-rce ~/.claude/skills/hunt-rce

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/H-mmer/pentest-agents.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file: skills/hunt-rce/SKILL.md in H-mmer/pentest-agents
Installs to: ~/.claude/skills/hunt-rce
Collection: One of 25 skills cataloged from this repository
Category: Quality — 1354 skills

What RCE Hunter does

RCE Hunter finds remote code execution attack surfaces in web apps, OSS libraries, CI/CD, containers, and agent tools. Use it when user input may reach shells, deserializers, template engines, loaders, or git and curl commands.

RCE Hunter is cataloged under Quality on DirSkills. RCE Hunter comes from a repository tagged agents, bug-bounty, bugcrowd, claude-code and hackerone.

Documentation

README

Excerpt

Crown Jewel Targets

RCE is the highest-paying class in bug bounty, and the 24-month meta has shifted decisively toward five asset types. All CVEs below are verified against NVD.

1. Modern JS framework deserialization (CVSS 10.0). React Server Components / React Server Functions / Next.js App Router. CVE-2025-55182 (CVSS 10.0, Meta Bug Bounty, Vercel WAF-bypass program on H1, exploited in the wild within 24 hours of disclosure) is the defining 2025-2026 RCE. Every Next.js >=14.3.0-canary.77 / >=15.x / >=16.x deployment running unpatched RSC is a one-request RCE target. Vercel maintains a separate H1 program paying low five-figure bounties for WAF bypasses against this CVE. Hunt this first on any modern JS stack.

This is the opening of the README. Read the full README on GitHub.

Commands RCE Hunter provides

Slash commands named in this skill’s SKILL.md, listed in the order they first appear.

/summarize
/exception
/invoke
/agent
/page
/robots
/script

Frequently asked about RCE Hunter

What else does H-mmer publish alongside RCE Hunter?
RCE Hunter is one of 25 skills that DirSkills catalogs from H-mmer/pentest-agents, the repository it ships in. Its siblings there include Analyze, Autopilot and Brain. Each one is a separate skill with its own page in this directory, installs the same way RCE Hunter does, and is maintained by H-mmer in that same repository. The rest of the collection is listed on the H-mmer/pentest-agents page.
How does RCE Hunter compare to other Quality skills?
RCE Hunter ranks #962 by stars among the 1354 Quality skills in this catalog. The most-starred ones next to it are Benchmark, Benchmark Optimization Loop and API Design Patterns. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of RCE Hunter against them. Open each page to compare what they document and how they install.