skill

bb-local-toolkit

Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, ghauri); for pure orchestration/routing use the bug-bounty skill. Workflow it covers — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use when you need the local install path of a tool / wordlist / clone for a hunt, or as the full-workflow variant when operating from this local toolkit; for general routing use the bug-bounty skill. 中文触发词：漏洞赏金、安全测试、渗透测试、漏洞挖掘、信息收集、子域名枚举、XSS测试、SQL注入、SSRF、安全审计、漏洞报告

Description as published by the maintainer. Source

• active

active — Most recent push to the repository was 2026-08-03.

Signals

These are separate measurements of different things. They are deliberately not combined into one score, because a popularity number that mixes website traffic with saves and stars cannot be checked or acted on.

Will this work with your setup?

Install location suggests this is meant for claude-code. The author tagged this repository "claude-skills" on GitHub. That is their statement of intent, not a test result.

We have not run this skill against a task with and without it enabled, so we cannot tell you whether it improves anything, what it costs in tokens, or whether it duplicates behaviour your harness already has. When we have run that test, the result will appear on this page with the task, the versions and the budget it used.

The skill definition lives at skills/bb-local-toolkit/SKILL.md in https://github.com/elementalsouls/Claude-BugHunter.

Where to get it

• Repository — https://github.com/elementalsouls/Claude-BugHunter

Related, by what their authors tagged them

• elementalsouls-claude-bughunter-apk-redteam-pipeline — last commit 2026-08-03, shares ai-security, application-security, bug-bounty
  End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx…
• elementalsouls-claude-bughunter-bb-methodology — last commit 2026-08-03, shares ai-security, application-security, bug-bounty
  Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next.…
• elementalsouls-claude-bughunter-bug-bounty — last commit 2026-08-03, shares ai-security, application-security, bug-bounty
  Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source c…
• elementalsouls-claude-bughunter-bugcrowd-reporting — last commit 2026-08-03, shares ai-security, application-security, bug-bounty
  Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exa…
• elementalsouls-claude-bughunter-cloud-iam-deep — last commit 2026-08-03, shares ai-security, application-security, bug-bounty
  Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-dis…
• elementalsouls-claude-bughunter-enterprise-vpn-attack — last commit 2026-08-03, shares ai-security, application-security, bug-bounty
  External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix Net…
• elementalsouls-claude-bughunter-evidence-hygiene — last commit 2026-08-03, shares ai-security, application-security, bug-bounty
  Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to ma…
• elementalsouls-claude-bughunter-hunt-api-misconfig — last commit 2026-08-03, shares ai-security, application-security, bug-bounty
  Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {…
• elementalsouls-claude-bughunter-hunt-aspnet — last commit 2026-08-03, shares ai-security, application-security, bug-bounty
  Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser…
• elementalsouls-claude-bughunter-hunt-ato — last commit 2026-08-03, shares ai-security, application-security, bug-bounty
  Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header inj…

These share tags the maintainers applied themselves, such as ai-security, application-security, bug-bounty, bugbounty. Common tags like "mcp" or "ai" are ignored for this: agreeing with six hundred other projects is not a similarity.

This is not a recommendation and not a test result. It is a map of what the authors said their work is about.

Also from elementalsouls

• elementalsouls-claude-bughunter-hunt-auth-bypass — last commit 2026-08-03
  Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differe…
• elementalsouls-claude-bughunter-hunt-brute-force — last commit 2026-08-03
  Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, c…
• elementalsouls-claude-bughunter-hunt-business-logic — last commit 2026-08-03
  Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking…
• elementalsouls-claude-bughunter-hunt-cache-poison — last commit 2026-08-03
  Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host pois…
• elementalsouls-claude-bughunter-hunt-captcha-bypass — last commit 2026-08-03
  Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation ab…
• elementalsouls-claude-bughunter-hunt-cicd — last commit 2026-08-03
  Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-s…
• elementalsouls-claude-bughunter-hunt-clickjacking — last commit 2026-08-03
  Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisibl…
• elementalsouls-claude-bughunter-hunt-cloud-misconfig — last commit 2026-08-03
  Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket polic…
• elementalsouls-claude-bughunter-hunt-cors — last commit 2026-08-03
  Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored…
• elementalsouls-claude-bughunter-hunt-csrf — last commit 2026-08-03
  Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=La…

How the author describes it

Topics the maintainer set on GitHub: ai-security, anthropic, application-security, bug-bounty, bugbounty, bugcrowd, claude, claude-code, claude-skills, ethical-hacking, hackerone, offensive-security, pentesting, red-team, security-tools, web-security.