本文へ移動
cccskills
無料GitHub で公開

bug-bounty

THE master bug bounty hunting skill — hasil merge arsenal 69 skill (bughunter-os, webhunter-os, open-kritt, ghost-scan, dll) + SYADAGENTIC-bugbounty v7.1 + submission review gate. Full-spectrum: recon, attack-surface mapping, bug discovery (Web/API, smart contract, crypto, infra), exploit dev, adversarial triage, evidence packaging, and submission. HARD FLOW: policy first, full recon pass, verify everything, hub before operator report, bug-bounty-submission-review gate before ANY submit, wait for operator "gas" before platform POST. Timer triggered whenever SYADAGENTIC is bug hunting or auditing anything. Includes 13 sub-skills, 28 commands, 10 agents, 51 tools, MCP servers, wordlists, tons of references.

日本語の概要は準備中です。原文の説明を表示しています。

Sekolah76/syadagenticスター 92(GitHub 92 + cccskills 0)
連携ツールGitHub

実行スコア 未検証

インストール方法を見る

含まれるファイル（162）

  • SKILL.md9.5 KB
  • agents/autopilot.md7.6 KB
  • agents/chain-builder.md4.3 KB
  • agents/credential-hunter.md7.1 KB
  • agents/README.md884 B
  • agents/recon-agent.md3.6 KB
  • agents/recon-ranker.md3.1 KB
  • agents/report-writer.md5.7 KB
  • agents/token-auditor.md7.3 KB
  • agents/validator.md5.0 KB
  • agents/web3-auditor.md5.3 KB
  • commands/arsenal.md1.7 KB
  • commands/autopilot.md4.3 KB
  • commands/breach-check.md3.8 KB
  • commands/bypass-403.md5.4 KB
  • commands/chain.md5.3 KB
  • commands/cloud-recon.md1.7 KB
  • commands/hunt.md12.7 KB
  • commands/intel.md1.7 KB
  • commands/memory-gc.md2.1 KB
  • commands/osint-employees.md3.4 KB
  • commands/param-discover.md1.5 KB
  • commands/pickup.md1.5 KB
  • commands/README.md947 B
  • commands/recon.md4.6 KB
  • commands/remember.md1.8 KB
  • commands/report.md4.4 KB
  • commands/scan-cves.md1.5 KB
  • commands/scope-aggregate.md1.8 KB
  • commands/scope.md3.9 KB
  • commands/secrets-hunt.md2.2 KB
  • commands/spray.md5.8 KB
  • commands/surface.md1.4 KB
  • commands/takeover.md1.6 KB
  • commands/token-scan.md4.5 KB
  • commands/triage.md3.9 KB
  • commands/validate.md4.6 KB
  • commands/web3-audit.md6.5 KB
  • commands/wordlist-gen.md3.3 KB
  • mcp/burp-mcp-client/config.json349 B
  • mcp/burp-mcp-client/opencode-config.json279 B
  • mcp/burp-mcp-client/README.md3.2 KB
  • mcp/caido-mcp-client/opencode-config.json305 B
  • mcp/caido-mcp-client/README.md3.3 KB
  • mcp/hackerone-mcp/config.json258 B
  • mcp/hackerone-mcp/opencode-config.json198 B
  • mcp/hackerone-mcp/server.py10.3 KB
  • mcp/README.md473 B
  • skills/bb-methodology/references/authenticated-program-baseline.md2.6 KB
  • skills/bb-methodology/references/controlled-siwe-validation.md3.0 KB
  • skills/bb-methodology/references/cosmos-sdk-precompile-authz.md4.2 KB
  • skills/bb-methodology/references/gas-hunting-web-no-auth.md2.7 KB
  • skills/bb-methodology/references/live-dapp-deployment-provenance.md4.3 KB
  • skills/bb-methodology/references/manual-only-program-policy.md2.3 KB
  • skills/bb-methodology/references/native-client-privacy-and-installer-validation.md6.5 KB
  • skills/bb-methodology/references/nym-vdp-bbp.md4.1 KB
  • skills/bb-methodology/references/open-kritt-integration.md4.4 KB
  • skills/bb-methodology/references/program-document-and-dapp-provenance.md2.9 KB
  • skills/bb-methodology/references/proton-bounty-policy.md2.0 KB
  • skills/bb-methodology/references/security-submission-bundle.md2.6 KB
  • skills/bb-methodology/references/stakedao-vlsdt-gas-griefing.md1.9 KB
  • skills/bb-methodology/references/synology-bounty-policy.md2.2 KB
  • skills/bb-methodology/references/two-account-authz-differential.md1.3 KB
  • skills/bb-methodology/SKILL.md33.2 KB
  • skills/bug-bounty/SKILL.md75.0 KB
  • skills/cicd-security/SKILL.md12.1 KB
  • skills/credential-attack/SKILL.md18.6 KB
  • skills/graphql-audit/SKILL.md16.5 KB
  • skills/meme-coin-audit/SKILL.md9.4 KB
  • skills/mobile-pentest/SKILL.md18.4 KB
  • skills/report-writing/references/capability-url-cart-bac-intigriti.md6.2 KB
  • skills/report-writing/references/h1-single-asset-form-fill.md2.7 KB
  • skills/report-writing/references/network-perspective-severity.md3.3 KB
  • skills/report-writing/references/obol-bls-keymanager-case.md5.8 KB
  • skills/report-writing/references/telegram-delivery-preferences.md2.5 KB
  • skills/report-writing/references/telegram-h1-attachments.md2.2 KB
  • skills/report-writing/SKILL.md34.1 KB
  • skills/security-arsenal/METHODOLOGY_CHEATSHEET.md5.7 KB
  • skills/security-arsenal/REFERENCES.md4.0 KB
  • skills/security-arsenal/SKILL.md60.1 KB
  • skills/triage-validation/references/external-verification-pattern.md6.1 KB
  • skills/triage-validation/references/mixed-dns-route-confusion.md3.6 KB
  • skills/triage-validation/references/ptai-spa-probe-false-positives.md5.1 KB
  • skills/triage-validation/references/web3-dapp-architecture-false-positives.md9.3 KB
  • skills/triage-validation/SKILL.md39.1 KB
  • skills/web2-recon/references/browser-gas-hunting-api-surface.md7.8 KB
  • skills/web2-recon/references/express_nestjs_api_probe.md4.0 KB
  • skills/web2-recon/references/nextjs_bundle_config_extraction.md5.8 KB
  • skills/web2-recon/references/passive_ct_dns_brute_curl_fingerprint.md5.5 KB
  • skills/web2-recon/references/payment-platform-sdk-recon.md4.1 KB
  • skills/web2-recon/references/sailsjs_recon_patterns.md5.8 KB
  • skills/web2-recon/references/vuejs_spa_bundle_extraction.md6.1 KB
  • skills/web2-recon/references/web3-dapp-frontend-rpc-recon.md6.2 KB
  • skills/web2-recon/SKILL.md22.1 KB
  • skills/web2-vuln-classes/references/oauth-oidc-recon-patterns.md11.1 KB
  • skills/web2-vuln-classes/SKILL.md81.9 KB
  • skills/web3-audit/references/cosmos-sdk-chain-audit.md2.0 KB
  • skills/web3-audit/references/etherscan-alternatives.md3.4 KB
  • skills/web3-audit/references/flash-loan-patterns.md4.5 KB
  • skills/web3-audit/references/initializer-frontrunning-onyx.md3.0 KB
  • skills/web3-audit/references/lo0p-lendinghook-audit-2026-07.md1.9 KB
  • skills/web3-audit/references/retroactive-reward-smearing.md2.5 KB
  • skills/web3-audit/references/scoped-source-provenance-and-regression.md2.0 KB
  • skills/web3-audit/SKILL.md41.5 KB
  • tools/__init__.py185 B
  • tools/_auth_helper.sh2.9 KB
  • tools/_spray_http_form.py9.7 KB
  • tools/_spray_oauth.py6.5 KB
  • tools/auth_session.py11.9 KB
  • tools/banner.py6.1 KB
  • tools/banner.sh4.6 KB
  • tools/breach_checker.py8.8 KB
  • tools/bypass_403.sh17.9 KB
  • tools/cicd_scanner.sh4.3 KB
  • tools/cloud_recon.sh5.0 KB
  • tools/credential_store.py3.1 KB
  • tools/cve_scan.sh3.7 KB
  • tools/dashboard.py20.2 KB
  • tools/external_arsenal.sh13.1 KB
  • tools/graphql_audit.sh13.3 KB
  • tools/h1_idor_scanner.py23.5 KB
  • tools/h1_mutation_idor.py12.0 KB
  • tools/h1_oauth_tester.py10.7 KB
  • tools/h1_race.py9.6 KB
  • tools/h1_run.sh5.8 KB
  • tools/hai_browser_recon.js6.2 KB
  • tools/hai_payload_builder.py33.1 KB
  • tools/hai_probe.py7.1 KB
  • tools/hunt.py22.3 KB
  • tools/intel_engine.py14.7 KB
  • tools/lead_board.py20.8 KB
  • tools/learn.py16.7 KB
  • tools/memory_gc.py5.4 KB
  • tools/mindmap.py16.7 KB
  • tools/multipart_mutator.py9.1 KB
  • tools/osint_employees.sh8.0 KB
  • tools/param_discovery.sh2.7 KB
  • tools/README.md2.2 KB
  • tools/recon_adapter.py13.3 KB
  • tools/recon_engine.sh31.5 KB
  • tools/scope_aggregator.sh8.0 KB
  • tools/scope_checker.py8.9 KB
  • tools/secrets_hunter.sh5.5 KB
  • tools/sneaky_bits.py9.0 KB
  • tools/spray_orchestrator.sh8.8 KB
  • tools/takeover_scanner.sh4.1 KB
  • tools/target_selector.py10.9 KB
  • tools/token_scanner.py29.2 KB
  • tools/validate.py36.8 KB
  • tools/vuln_scanner.sh30.9 KB
  • tools/waf_encoder.py7.8 KB
  • tools/waf_response_analyzer.py31.0 KB
  • tools/wordlist_engine.sh6.7 KB
  • tools/zendesk_idor_test.py13.4 KB
  • tools/zero_day_fuzzer.py22.0 KB
  • wordlists/api-endpoints.txt4.4 KB
  • wordlists/common.txt37.6 KB
  • wordlists/params.txt52.9 KB
  • wordlists/raft-medium-dirs.txt244.6 KB
  • wordlists/README.md565 B
  • wordlists/REFERENCES.md2.9 KB
  • wordlists/sensitive-files.txt1.3 KB

SKILL.md（原文）

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Bug Bounty — Master Hunting Skill (MERGED ARSENAL)

Satu skill untuk semua bug bounty. Merge dari: arsenal 69-skill zip + SYADAGENTIC-bugbounty v7.1 + submission review gate.

Triggers

  • bug bounty / bugbounty / hunting / hunt target / bounty program
  • recon / reconnaissance / enumerate / attack surface / subdomain / port scan
  • audit smart contract / dApp / solidity / vyper / solana / move / cosmwasm / on-chain
  • exploit / break / PoC / proof of concept / working exploit / chain / RCE / code injection
  • injection / SQLi / SSTI / SSRF / XXE / LFI / IDOR / XSS / CSRF / JWT / OAuth / GraphQL
  • vulnerability / finding / bug / triage / dedup / scope / out-of-scope
  • report / write-up / submission / CVSS / CWE / severity
  • HackerOne / Bugcrowd / Intigriti / Immunefi / YesWeHack / Code4rena / Sherlock / Cantina
  • "nyari bug", "gas cari bug", "hunting", "bug bounty"

INPUT / OPERATING RULE

  • target — asset/scope (domain, repo, contract address, dApp)
  • program — program name + policy/scope link
  • phase — scope | recon | analyze | verify | exploit | report | triage (auto-detect)

Authorized targets only (owned or in-scope bounty program). Working exploits over theory. Ship fast. No fabrication — real tool output or honest blocker.

HARD FLOW (operator lock — SYADAGENTIC 2026-07-19)

Do this order. No skip. No early chat dump.

  1. READ THE MERGED STACK — sub-skills live under skills/, references under references/, commands under commands/, agents under agents/, tools under tools/. Route per phase via table below. Then execute.
  2. SCAN ONLY IN-SCOPE — Lock program policy first. In-scope assets only. Drop OOS immediately (staging, 3rd-party host, rate-limit spam unless asked).
  3. DEEP-DIVE RECON (full explore once) — One thorough pass, not drip-feed. Passive → active → targeted. Map attack surface complete before hunting loops.
  4. FIND → VERIFY + AUDIT — Candidate is not a finding yet. Live re-test. Valid / reject with real proof (request/response, file:line, PoC). Finish ALL verifications before any operator report.
  5. VALID ONLY → HUB :9000 + SS — Write report + evidence under ~/workspace/bug-hunter/public-reports/<project>/, rebuild hub. SS: real browser on live target (URL bar = target) or rendered code SS when bug is not browser-visible.
  6. SUBMISSION GATE (INLINE — 14 checklist, no report leaves without passing):
    1. VALIDASI — reproduce minimal 5x, jalankan di commit terbaru + fork/mainnet-equivalent, hasil konsisten.
    2. IMPACT — buktikan impact nyata: apa yang dicuri/rusak, siapa dirugikan, berapa max loss, exploit realistis?
    3. POC — repeatable, end-to-end, tanpa asumsi tidak realistis, tanpa privileged access (kecuali threat model).
    4. ROOT CAUSE — kenapa bug terjadi, kenapa validasi gagal, fungsi terlibat, call flow, state transition.
    5. SCOPE — asset/commit/contract in-scope, bukan third-party issue.
    6. EXCLUSION — bukan intended behavior, governance, admin risk, centralization, missing best practice, informational, gas, style, dead code tanpa impact.
    7. DUPLICATE — cek GitHub Issues, PRs, audit reports, known issues, disclosures, public writeups.
    8. PATCH — pastikan belum diperbaiki.
    9. REPORT QUALITY — wajib ada: Title, Summary, Root Cause, Tech Details, Impact, PoC, Repro Steps, Evidence, Recommended Fix, References.
    10. SEVERITY — hitung CVSS + CWE + likelihood + exploitability + business impact.
    11. CONFIDENCE SCORE — validity, exploitability, impact, dup-risk, report quality (0-100).
    12. FINAL DECISION — SATU output: READY TO SUBMIT / NEED MORE EVIDENCE / POSSIBLE DUPLICATE / OUT OF SCOPE / DESIGN DECISION / FALSE POSITIVE.
    13. SUBMISSION RULE — tidak melebih-lebihkan severity, tidak mengarang impact/bounty, no Critical tanpa PoC rugi nyata, tidak auto-submit.
    14. SELF-CRITIQUE — review sebagai triager: kenapa chek ini ditolak? bukti apa kurang? ada interpretasi intended lainnya? confidence 0-100% diterima? READY TO SUBMIT HANYA jika 1-14 semua lolos.
  7. REPORT TO OPERATOR LAST — Only after steps 1–5 done for the batch. JANGAN report ke SYADAGENTIC sebelum verif + audit + hub. Then wait for gas before any platform submit (H1/Sherlock/Cantina/Discord).

Routing Table (fase → sub-skill)

FaseTipeSub-skill / reference
Scope & PolicySemuaskills/bounty-policy-agent · responsible-disclosure-off-program · skills/bb-methodology
ReconWeb/APIskills/web2-recon · shodan-reconnaissance · subdomain-takeover · crawl4ai-recon · manual-recon-cors-leaks · skills/web2-recon
ReconSC/Web3bughunter-os (phase1) · entry-point-analyzer · solana-scanner · on-chain-forensics
Attack SurfaceWeb/APIapi-fuzzing-bug-bounty · http2-attacks · webhunter-os (phases 1-3)
Attack SurfaceSCattack-surface-mapper · entry-point-analyzer (solidity/vyper/move/solana/ton/cosmwasm)
Bug DiscoveryWeb/APIwebhunter-os (pattern libs) · skills/web2-vuln-classes · xss-scanner · xss-html-injection · sql-injection-testing · html-injection-testing · code-injection-detector · sqlmap-database-pentesting
Bug DiscoverySCbughunter-os (attack patterns) · smart-contract-audit · solidity-security · sc-vulns · skills/web3-audit · web3-audit/*
Bug DiscoveryCryptocrypto-ctf-solving · ctf-crypto · encrypt-decrypt
Chain AnalysisSemuaattack-chaining-core · attack-chain-web2 · attack-chain-web3 · variant-discovery
Exploit DevWeb/APIexploitability-analyzer · exploit-to-confirm · vulnerability-scanner
Exploit DevSCbughunter2 (PoC phase) · evm-fuzzing-resources · web3-audit/rounding-zero-shortcut-exploit
VerificationSemuaverifier-agent · security-finding-triage · root-cause-analyzer · skills/triage-validation
EvidenceSemuaevidence-packager (manifest + bundle layout)
ReportSemuasecurity-finding-triage (final) · skills/report-writing · bug-hunter-report
Pre-Submit GATESemuasubmission-gate · skills/triage-validation (7-Question Gate) — WAJIB
GuardrailsSemuasecurity-research-guardrail · guidelines-advisor

Sub-skills & Assets (from the merged toolkit)

  • 13 sub-skills in skills/: bug-bounty (master), bb-methodology, web2-recon, web2-vuln-classes, security-arsenal, web3-audit, meme-coin-audit, report-writing, triage-validation, cicd-security, credential-attack, graphql-audit, mobile-pentest
  • 28 commands in commands/: hunt, recon, chain, cloud-recon, bypass-403, xxsbypass, breach-check, intel, pickup, remember, godmode, genjson, wafcheck, fuzz, auth-tests, etc.
  • 10 agents in agents/: recon-agent, recon-ranker, validator, token-auditor, web3-auditor, chain-builder, report-writer, credential-hunter, autopilot
  • Reports: skills/report-writing → templates per platform (H1/Bugcrowd/Intigriti/Immunefi)
    • CVSS 3.1 scoring framework + CWE mapping
  • Wordlists in wordlists/, MCP clients in mcp/ (Burp, Caido, HackerOne)
  • References in references/ (50+ files: recon, vuln classes, reporting, verification, grpc-web, graphql, oauth, waf-bypass, subdomain & storage probing, evidence hub, smart-contract bounty audit workflow)

Severity (Immunefi scale for Web3)

🔴 Critical — direct loss of funds, no constraints · 🟠 High — loss with constraints / permanent freeze · 🟡 Medium — DoS, griefing, logic errors · 🟢 Low — minor / gas · 🔵 Info — best practice. Web: use CVSS 3.1/4.0.

Quality bar (self-check)

  • Working exploit code, not just theory
  • Every step reproducible without guessing
  • CVSS/severity backed by real impact argument
  • Actionable remediation for the dev team
  • No unverified claim presented as fact — real tool output or honest blocker
  • Deep, not shallow — every claim traced to source/live endpoint/tool output
  • Minimal chatter — findings direct, no preamble

Assignment rules

  • Info-only = don't draft (operator preference: "info mah gausah"). Only escalate solid Low/Medium/High/Critical against program OOS.
  • Duplicate check before submission (GitHub Issues/PRs, audit reports, known issues, public writeups).
  • Never over-claim severity; never fabricate impact/bounty; never auto-submit — operator gas required.

Notes

  • Foundry default for Web3 PoCs (forge test, fork with anvil --fork-url).
  • Prefer manual verification over scanner output. Redact tokens/cookies/PII in artifacts.
  • Screenshots only after confirmed; real browser on live target. Port 9000 hub only.
  • Update this skill when you learn new patterns.

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

コメント

ログインなしで書き込めます。使ってみた感想、質問、動かなかった環境などを気軽にどうぞ。

まだコメントはありません。最初のコメントを書いてみませんか。

送信するとすぐに公開されます。メールアドレスや電話番号などの個人情報は書かないでください。URL は 2 つまでです。

0 / 1000 文字

このフォームは reCAPTCHA で保護されており、Google のプライバシーポリシーと利用規約が適用されます。

同じリポジトリのスキル

api-fuzzing-bug-bounty

無料

Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.

日本語の概要は準備中です。原文の説明を表示しています。

Sekolah76/syadagentic922026年8月27日 更新

attack-chain-web2

無料

Web2 attack chain plugin — apply Web2 trust boundaries and composition rules on top of attack-chaining-core for authorized testing of web apps, APIs, identity, cloud, and internal services.

日本語の概要は準備中です。原文の説明を表示しています。

Sekolah76/syadagentic922026年8月27日 更新

attack-chain-web3

無料

Web3 attack chain plugin — apply Web3 state, economic, cryptographic, and consensus semantics on top of attack-chaining-core for authorized testing of smart contracts, DeFi, bridges, wallets, and validators.

日本語の概要は準備中です。原文の説明を表示しています。

Sekolah76/syadagentic922026年8月27日 更新

attack-chaining-core

無料

Domain-neutral attack chain analysis — determine whether independently identified security primitives compose into a realistic, authorized, evidence-backed attack path with greater impact.

日本語の概要は準備中です。原文の説明を表示しています。

Sekolah76/syadagentic922026年8月27日 更新

attack-surface-mapper

無料

Build an evidence-backed map of externally and internally reachable attack surfaces, trust boundaries, privileged transitions, security assets, and high-value audit targets before vulnerability hunting.

日本語の概要は準備中です。原文の説明を表示しています。

Sekolah76/syadagentic922026年8月27日 更新

bb-methodology

無料

Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If experiments). Routes to all other skills based on current hunting phase. Also use when asking "what should I do next" or "where am I in the process."

日本語の概要は準備中です。原文の説明を表示しています。

Sekolah76/syadagentic922026年8月27日 更新

Sekolah76 のスキルをすべて見る

このスキルの問題を報告する