Skip to content
cccskills
FreePublished on GitHub

bug-bounty

THE master bug bounty hunting skill — hasil merge arsenal 69 skill (bughunter-os, webhunter-os, open-kritt, ghost-scan, dll) + SYADAGENTIC-bugbounty v7.1 + submission review gate. Full-spectrum: recon, attack-surface mapping, bug discovery (Web/API, smart contract, crypto, infra), exploit dev, adversarial triage, evidence packaging, and submission. HARD FLOW: policy first, full recon pass, verify everything, hub before operator report, bug-bounty-submission-review gate before ANY submit, wait for operator "gas" before platform POST. Timer triggered whenever SYADAGENTIC is bug hunting or auditing anything. Includes 13 sub-skills, 28 commands, 10 agents, 51 tools, MCP servers, wordlists, tons of references.

The English summary is being prepared. Showing the original description.

Sekolah76/syadagentic92 stars(GitHub 92 + cccskills 0)
Works withGitHub

Run score Not tested

See how to install

Files included (162)

  • SKILL.md9.5 KB
  • agents/autopilot.md7.6 KB
  • agents/chain-builder.md4.3 KB
  • agents/credential-hunter.md7.1 KB
  • agents/README.md884 B
  • agents/recon-agent.md3.6 KB
  • agents/recon-ranker.md3.1 KB
  • agents/report-writer.md5.7 KB
  • agents/token-auditor.md7.3 KB
  • agents/validator.md5.0 KB
  • agents/web3-auditor.md5.3 KB
  • commands/arsenal.md1.7 KB
  • commands/autopilot.md4.3 KB
  • commands/breach-check.md3.8 KB
  • commands/bypass-403.md5.4 KB
  • commands/chain.md5.3 KB
  • commands/cloud-recon.md1.7 KB
  • commands/hunt.md12.7 KB
  • commands/intel.md1.7 KB
  • commands/memory-gc.md2.1 KB
  • commands/osint-employees.md3.4 KB
  • commands/param-discover.md1.5 KB
  • commands/pickup.md1.5 KB
  • commands/README.md947 B
  • commands/recon.md4.6 KB
  • commands/remember.md1.8 KB
  • commands/report.md4.4 KB
  • commands/scan-cves.md1.5 KB
  • commands/scope-aggregate.md1.8 KB
  • commands/scope.md3.9 KB
  • commands/secrets-hunt.md2.2 KB
  • commands/spray.md5.8 KB
  • commands/surface.md1.4 KB
  • commands/takeover.md1.6 KB
  • commands/token-scan.md4.5 KB
  • commands/triage.md3.9 KB
  • commands/validate.md4.6 KB
  • commands/web3-audit.md6.5 KB
  • commands/wordlist-gen.md3.3 KB
  • mcp/burp-mcp-client/config.json349 B
  • mcp/burp-mcp-client/opencode-config.json279 B
  • mcp/burp-mcp-client/README.md3.2 KB
  • mcp/caido-mcp-client/opencode-config.json305 B
  • mcp/caido-mcp-client/README.md3.3 KB
  • mcp/hackerone-mcp/config.json258 B
  • mcp/hackerone-mcp/opencode-config.json198 B
  • mcp/hackerone-mcp/server.py10.3 KB
  • mcp/README.md473 B
  • skills/bb-methodology/references/authenticated-program-baseline.md2.6 KB
  • skills/bb-methodology/references/controlled-siwe-validation.md3.0 KB
  • skills/bb-methodology/references/cosmos-sdk-precompile-authz.md4.2 KB
  • skills/bb-methodology/references/gas-hunting-web-no-auth.md2.7 KB
  • skills/bb-methodology/references/live-dapp-deployment-provenance.md4.3 KB
  • skills/bb-methodology/references/manual-only-program-policy.md2.3 KB
  • skills/bb-methodology/references/native-client-privacy-and-installer-validation.md6.5 KB
  • skills/bb-methodology/references/nym-vdp-bbp.md4.1 KB
  • skills/bb-methodology/references/open-kritt-integration.md4.4 KB
  • skills/bb-methodology/references/program-document-and-dapp-provenance.md2.9 KB
  • skills/bb-methodology/references/proton-bounty-policy.md2.0 KB
  • skills/bb-methodology/references/security-submission-bundle.md2.6 KB
  • skills/bb-methodology/references/stakedao-vlsdt-gas-griefing.md1.9 KB
  • skills/bb-methodology/references/synology-bounty-policy.md2.2 KB
  • skills/bb-methodology/references/two-account-authz-differential.md1.3 KB
  • skills/bb-methodology/SKILL.md33.2 KB
  • skills/bug-bounty/SKILL.md75.0 KB
  • skills/cicd-security/SKILL.md12.1 KB
  • skills/credential-attack/SKILL.md18.6 KB
  • skills/graphql-audit/SKILL.md16.5 KB
  • skills/meme-coin-audit/SKILL.md9.4 KB
  • skills/mobile-pentest/SKILL.md18.4 KB
  • skills/report-writing/references/capability-url-cart-bac-intigriti.md6.2 KB
  • skills/report-writing/references/h1-single-asset-form-fill.md2.7 KB
  • skills/report-writing/references/network-perspective-severity.md3.3 KB
  • skills/report-writing/references/obol-bls-keymanager-case.md5.8 KB
  • skills/report-writing/references/telegram-delivery-preferences.md2.5 KB
  • skills/report-writing/references/telegram-h1-attachments.md2.2 KB
  • skills/report-writing/SKILL.md34.1 KB
  • skills/security-arsenal/METHODOLOGY_CHEATSHEET.md5.7 KB
  • skills/security-arsenal/REFERENCES.md4.0 KB
  • skills/security-arsenal/SKILL.md60.1 KB
  • skills/triage-validation/references/external-verification-pattern.md6.1 KB
  • skills/triage-validation/references/mixed-dns-route-confusion.md3.6 KB
  • skills/triage-validation/references/ptai-spa-probe-false-positives.md5.1 KB
  • skills/triage-validation/references/web3-dapp-architecture-false-positives.md9.3 KB
  • skills/triage-validation/SKILL.md39.1 KB
  • skills/web2-recon/references/browser-gas-hunting-api-surface.md7.8 KB
  • skills/web2-recon/references/express_nestjs_api_probe.md4.0 KB
  • skills/web2-recon/references/nextjs_bundle_config_extraction.md5.8 KB
  • skills/web2-recon/references/passive_ct_dns_brute_curl_fingerprint.md5.5 KB
  • skills/web2-recon/references/payment-platform-sdk-recon.md4.1 KB
  • skills/web2-recon/references/sailsjs_recon_patterns.md5.8 KB
  • skills/web2-recon/references/vuejs_spa_bundle_extraction.md6.1 KB
  • skills/web2-recon/references/web3-dapp-frontend-rpc-recon.md6.2 KB
  • skills/web2-recon/SKILL.md22.1 KB
  • skills/web2-vuln-classes/references/oauth-oidc-recon-patterns.md11.1 KB
  • skills/web2-vuln-classes/SKILL.md81.9 KB
  • skills/web3-audit/references/cosmos-sdk-chain-audit.md2.0 KB
  • skills/web3-audit/references/etherscan-alternatives.md3.4 KB
  • skills/web3-audit/references/flash-loan-patterns.md4.5 KB
  • skills/web3-audit/references/initializer-frontrunning-onyx.md3.0 KB
  • skills/web3-audit/references/lo0p-lendinghook-audit-2026-07.md1.9 KB
  • skills/web3-audit/references/retroactive-reward-smearing.md2.5 KB
  • skills/web3-audit/references/scoped-source-provenance-and-regression.md2.0 KB
  • skills/web3-audit/SKILL.md41.5 KB
  • tools/__init__.py185 B
  • tools/_auth_helper.sh2.9 KB
  • tools/_spray_http_form.py9.7 KB
  • tools/_spray_oauth.py6.5 KB
  • tools/auth_session.py11.9 KB
  • tools/banner.py6.1 KB
  • tools/banner.sh4.6 KB
  • tools/breach_checker.py8.8 KB
  • tools/bypass_403.sh17.9 KB
  • tools/cicd_scanner.sh4.3 KB
  • tools/cloud_recon.sh5.0 KB
  • tools/credential_store.py3.1 KB
  • tools/cve_scan.sh3.7 KB
  • tools/dashboard.py20.2 KB
  • tools/external_arsenal.sh13.1 KB
  • tools/graphql_audit.sh13.3 KB
  • tools/h1_idor_scanner.py23.5 KB
  • tools/h1_mutation_idor.py12.0 KB
  • tools/h1_oauth_tester.py10.7 KB
  • tools/h1_race.py9.6 KB
  • tools/h1_run.sh5.8 KB
  • tools/hai_browser_recon.js6.2 KB
  • tools/hai_payload_builder.py33.1 KB
  • tools/hai_probe.py7.1 KB
  • tools/hunt.py22.3 KB
  • tools/intel_engine.py14.7 KB
  • tools/lead_board.py20.8 KB
  • tools/learn.py16.7 KB
  • tools/memory_gc.py5.4 KB
  • tools/mindmap.py16.7 KB
  • tools/multipart_mutator.py9.1 KB
  • tools/osint_employees.sh8.0 KB
  • tools/param_discovery.sh2.7 KB
  • tools/README.md2.2 KB
  • tools/recon_adapter.py13.3 KB
  • tools/recon_engine.sh31.5 KB
  • tools/scope_aggregator.sh8.0 KB
  • tools/scope_checker.py8.9 KB
  • tools/secrets_hunter.sh5.5 KB
  • tools/sneaky_bits.py9.0 KB
  • tools/spray_orchestrator.sh8.8 KB
  • tools/takeover_scanner.sh4.1 KB
  • tools/target_selector.py10.9 KB
  • tools/token_scanner.py29.2 KB
  • tools/validate.py36.8 KB
  • tools/vuln_scanner.sh30.9 KB
  • tools/waf_encoder.py7.8 KB
  • tools/waf_response_analyzer.py31.0 KB
  • tools/wordlist_engine.sh6.7 KB
  • tools/zendesk_idor_test.py13.4 KB
  • tools/zero_day_fuzzer.py22.0 KB
  • wordlists/api-endpoints.txt4.4 KB
  • wordlists/common.txt37.6 KB
  • wordlists/params.txt52.9 KB
  • wordlists/raft-medium-dirs.txt244.6 KB
  • wordlists/README.md565 B
  • wordlists/REFERENCES.md2.9 KB
  • wordlists/sensitive-files.txt1.3 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Bug Bounty — Master Hunting Skill (MERGED ARSENAL)

Satu skill untuk semua bug bounty. Merge dari: arsenal 69-skill zip + SYADAGENTIC-bugbounty v7.1 + submission review gate.

Triggers

  • bug bounty / bugbounty / hunting / hunt target / bounty program
  • recon / reconnaissance / enumerate / attack surface / subdomain / port scan
  • audit smart contract / dApp / solidity / vyper / solana / move / cosmwasm / on-chain
  • exploit / break / PoC / proof of concept / working exploit / chain / RCE / code injection
  • injection / SQLi / SSTI / SSRF / XXE / LFI / IDOR / XSS / CSRF / JWT / OAuth / GraphQL
  • vulnerability / finding / bug / triage / dedup / scope / out-of-scope
  • report / write-up / submission / CVSS / CWE / severity
  • HackerOne / Bugcrowd / Intigriti / Immunefi / YesWeHack / Code4rena / Sherlock / Cantina
  • "nyari bug", "gas cari bug", "hunting", "bug bounty"

INPUT / OPERATING RULE

  • target — asset/scope (domain, repo, contract address, dApp)
  • program — program name + policy/scope link
  • phase — scope | recon | analyze | verify | exploit | report | triage (auto-detect)

Authorized targets only (owned or in-scope bounty program). Working exploits over theory. Ship fast. No fabrication — real tool output or honest blocker.

HARD FLOW (operator lock — SYADAGENTIC 2026-07-19)

Do this order. No skip. No early chat dump.

  1. READ THE MERGED STACK — sub-skills live under skills/, references under references/, commands under commands/, agents under agents/, tools under tools/. Route per phase via table below. Then execute.
  2. SCAN ONLY IN-SCOPE — Lock program policy first. In-scope assets only. Drop OOS immediately (staging, 3rd-party host, rate-limit spam unless asked).
  3. DEEP-DIVE RECON (full explore once) — One thorough pass, not drip-feed. Passive → active → targeted. Map attack surface complete before hunting loops.
  4. FIND → VERIFY + AUDIT — Candidate is not a finding yet. Live re-test. Valid / reject with real proof (request/response, file:line, PoC). Finish ALL verifications before any operator report.
  5. VALID ONLY → HUB :9000 + SS — Write report + evidence under ~/workspace/bug-hunter/public-reports/<project>/, rebuild hub. SS: real browser on live target (URL bar = target) or rendered code SS when bug is not browser-visible.
  6. SUBMISSION GATE (INLINE — 14 checklist, no report leaves without passing):
    1. VALIDASI — reproduce minimal 5x, jalankan di commit terbaru + fork/mainnet-equivalent, hasil konsisten.
    2. IMPACT — buktikan impact nyata: apa yang dicuri/rusak, siapa dirugikan, berapa max loss, exploit realistis?
    3. POC — repeatable, end-to-end, tanpa asumsi tidak realistis, tanpa privileged access (kecuali threat model).
    4. ROOT CAUSE — kenapa bug terjadi, kenapa validasi gagal, fungsi terlibat, call flow, state transition.
    5. SCOPE — asset/commit/contract in-scope, bukan third-party issue.
    6. EXCLUSION — bukan intended behavior, governance, admin risk, centralization, missing best practice, informational, gas, style, dead code tanpa impact.
    7. DUPLICATE — cek GitHub Issues, PRs, audit reports, known issues, disclosures, public writeups.
    8. PATCH — pastikan belum diperbaiki.
    9. REPORT QUALITY — wajib ada: Title, Summary, Root Cause, Tech Details, Impact, PoC, Repro Steps, Evidence, Recommended Fix, References.
    10. SEVERITY — hitung CVSS + CWE + likelihood + exploitability + business impact.
    11. CONFIDENCE SCORE — validity, exploitability, impact, dup-risk, report quality (0-100).
    12. FINAL DECISION — SATU output: READY TO SUBMIT / NEED MORE EVIDENCE / POSSIBLE DUPLICATE / OUT OF SCOPE / DESIGN DECISION / FALSE POSITIVE.
    13. SUBMISSION RULE — tidak melebih-lebihkan severity, tidak mengarang impact/bounty, no Critical tanpa PoC rugi nyata, tidak auto-submit.
    14. SELF-CRITIQUE — review sebagai triager: kenapa chek ini ditolak? bukti apa kurang? ada interpretasi intended lainnya? confidence 0-100% diterima? READY TO SUBMIT HANYA jika 1-14 semua lolos.
  7. REPORT TO OPERATOR LAST — Only after steps 1–5 done for the batch. JANGAN report ke SYADAGENTIC sebelum verif + audit + hub. Then wait for gas before any platform submit (H1/Sherlock/Cantina/Discord).

Routing Table (fase → sub-skill)

FaseTipeSub-skill / reference
Scope & PolicySemuaskills/bounty-policy-agent · responsible-disclosure-off-program · skills/bb-methodology
ReconWeb/APIskills/web2-recon · shodan-reconnaissance · subdomain-takeover · crawl4ai-recon · manual-recon-cors-leaks · skills/web2-recon
ReconSC/Web3bughunter-os (phase1) · entry-point-analyzer · solana-scanner · on-chain-forensics
Attack SurfaceWeb/APIapi-fuzzing-bug-bounty · http2-attacks · webhunter-os (phases 1-3)
Attack SurfaceSCattack-surface-mapper · entry-point-analyzer (solidity/vyper/move/solana/ton/cosmwasm)
Bug DiscoveryWeb/APIwebhunter-os (pattern libs) · skills/web2-vuln-classes · xss-scanner · xss-html-injection · sql-injection-testing · html-injection-testing · code-injection-detector · sqlmap-database-pentesting
Bug DiscoverySCbughunter-os (attack patterns) · smart-contract-audit · solidity-security · sc-vulns · skills/web3-audit · web3-audit/*
Bug DiscoveryCryptocrypto-ctf-solving · ctf-crypto · encrypt-decrypt
Chain AnalysisSemuaattack-chaining-core · attack-chain-web2 · attack-chain-web3 · variant-discovery
Exploit DevWeb/APIexploitability-analyzer · exploit-to-confirm · vulnerability-scanner
Exploit DevSCbughunter2 (PoC phase) · evm-fuzzing-resources · web3-audit/rounding-zero-shortcut-exploit
VerificationSemuaverifier-agent · security-finding-triage · root-cause-analyzer · skills/triage-validation
EvidenceSemuaevidence-packager (manifest + bundle layout)
ReportSemuasecurity-finding-triage (final) · skills/report-writing · bug-hunter-report
Pre-Submit GATESemuasubmission-gate · skills/triage-validation (7-Question Gate) — WAJIB
GuardrailsSemuasecurity-research-guardrail · guidelines-advisor

Sub-skills & Assets (from the merged toolkit)

  • 13 sub-skills in skills/: bug-bounty (master), bb-methodology, web2-recon, web2-vuln-classes, security-arsenal, web3-audit, meme-coin-audit, report-writing, triage-validation, cicd-security, credential-attack, graphql-audit, mobile-pentest
  • 28 commands in commands/: hunt, recon, chain, cloud-recon, bypass-403, xxsbypass, breach-check, intel, pickup, remember, godmode, genjson, wafcheck, fuzz, auth-tests, etc.
  • 10 agents in agents/: recon-agent, recon-ranker, validator, token-auditor, web3-auditor, chain-builder, report-writer, credential-hunter, autopilot
  • Reports: skills/report-writing → templates per platform (H1/Bugcrowd/Intigriti/Immunefi)
    • CVSS 3.1 scoring framework + CWE mapping
  • Wordlists in wordlists/, MCP clients in mcp/ (Burp, Caido, HackerOne)
  • References in references/ (50+ files: recon, vuln classes, reporting, verification, grpc-web, graphql, oauth, waf-bypass, subdomain & storage probing, evidence hub, smart-contract bounty audit workflow)

Severity (Immunefi scale for Web3)

🔴 Critical — direct loss of funds, no constraints · 🟠 High — loss with constraints / permanent freeze · 🟡 Medium — DoS, griefing, logic errors · 🟢 Low — minor / gas · 🔵 Info — best practice. Web: use CVSS 3.1/4.0.

Quality bar (self-check)

  • Working exploit code, not just theory
  • Every step reproducible without guessing
  • CVSS/severity backed by real impact argument
  • Actionable remediation for the dev team
  • No unverified claim presented as fact — real tool output or honest blocker
  • Deep, not shallow — every claim traced to source/live endpoint/tool output
  • Minimal chatter — findings direct, no preamble

Assignment rules

  • Info-only = don't draft (operator preference: "info mah gausah"). Only escalate solid Low/Medium/High/Critical against program OOS.
  • Duplicate check before submission (GitHub Issues/PRs, audit reports, known issues, public writeups).
  • Never over-claim severity; never fabricate impact/bounty; never auto-submit — operator gas required.

Notes

  • Foundry default for Web3 PoCs (forge test, fork with anvil --fork-url).
  • Prefer manual verification over scanner output. Redact tokens/cookies/PII in artifacts.
  • Screenshots only after confirmed; real browser on live target. Port 9000 hub only.
  • Update this skill when you learn new patterns.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

api-fuzzing-bug-bounty

Free

Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.

The English summary is being prepared. Showing the original description.

Sekolah76/syadagentic92Updated Aug 27, 2026

attack-chain-web2

Free

Web2 attack chain plugin — apply Web2 trust boundaries and composition rules on top of attack-chaining-core for authorized testing of web apps, APIs, identity, cloud, and internal services.

The English summary is being prepared. Showing the original description.

Sekolah76/syadagentic92Updated Aug 27, 2026

attack-chain-web3

Free

Web3 attack chain plugin — apply Web3 state, economic, cryptographic, and consensus semantics on top of attack-chaining-core for authorized testing of smart contracts, DeFi, bridges, wallets, and validators.

The English summary is being prepared. Showing the original description.

Sekolah76/syadagentic92Updated Aug 27, 2026

attack-chaining-core

Free

Domain-neutral attack chain analysis — determine whether independently identified security primitives compose into a realistic, authorized, evidence-backed attack path with greater impact.

The English summary is being prepared. Showing the original description.

Sekolah76/syadagentic92Updated Aug 27, 2026

attack-surface-mapper

Free

Build an evidence-backed map of externally and internally reachable attack surfaces, trust boundaries, privileged transitions, security assets, and high-value audit targets before vulnerability hunting.

The English summary is being prepared. Showing the original description.

Sekolah76/syadagentic92Updated Aug 27, 2026

bb-methodology

Free

Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If experiments). Routes to all other skills based on current hunting phase. Also use when asking "what should I do next" or "where am I in the process."

The English summary is being prepared. Showing the original description.

Sekolah76/syadagentic92Updated Aug 27, 2026

See all skills by Sekolah76

Report a problem with this skill