{"id":23721,"date":"2008-12-20T11:54:52","date_gmt":"2008-12-20T11:54:52","guid":{"rendered":"https:\/\/scannn.com\/github-elementalsouls-claude-bughunter-a-claude-code-skill-bundle-for-bug-hunting-and-external-red-team-work\/"},"modified":"2008-12-20T11:54:52","modified_gmt":"2008-12-20T11:54:52","slug":"github-elementalsouls-claude-bughunter-a-claude-code-skill-bundle-for-bug-hunting-and-external-red-team-work","status":"publish","type":"post","link":"https:\/\/scannn.com\/lv\/github-elementalsouls-claude-bughunter-a-claude-code-skill-bundle-for-bug-hunting-and-external-red-team-work\/","title":{"rendered":"GitHub - elementalsouls\/Claude-BugHunter: A Claude Code skill bundle for bug hunting and external red-team work"},"content":{"rendered":"\n<div id=\"\">\n<p dir=\"auto\"><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/assets\/banner-v2.svg\"><\/a><\/p>\n<blockquote>\n<p dir=\"auto\">A self-contained Claude skill bundle for bug hunting and external red-team work \u00b7 <strong>83 skills<\/strong> \u00b7 15 slash commands \u00b7 <strong>681 disclosed-report patterns<\/strong> (433 now individually cited &amp; auditable) across 24 core vulnerability classes \u00b7 enterprise identity + infrastructure attack matrices \u00b7 engagement-folder scaffolding \u00b7 Burp MCP integration \u00b7 battle-tested across authorized red-team and bug-hunting engagements, plus public training platforms (DVWA, OWASP Juice Shop, Hacker101, testphp.vulnweb.com).<\/p>\n<\/blockquote>\n<p dir=\"auto\">Built by <strong><a href=\"https:\/\/www.linkedin.com\/in\/sachinsharma8080\/\" rel=\"nofollow\">Sachin Sharma<\/a><\/strong> \u2014 Bug Hunting &amp; GenAI Security Research.<\/p>\n<p align=\"center\" dir=\"auto\">\n  <sub>SPONSORED BY<\/sub><br \/>\n  <br \/><a href=\"https:\/\/www.atlascloud.ai\/console\/coding-plan\" rel=\"nofollow\">\n    <themed-picture data-catalyst-inline=\"true\"><picture><source media=\"(prefers-color-scheme: dark)\" srcset=\"https:\/\/github.comhttps:\/\/github.com\/elementalsouls\/Claude-BugHunter\/raw\/main\/assets\/sponsors\/atlas-cloud-dark.svg\"><img decoding=\"async\" alt=\"Atlas Cloud\" src=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/raw\/main\/assets\/sponsors\/atlas-cloud-light.svg\" height=\"36\"\/><br \/>\n    <\/source><\/picture><\/themed-picture>\n  <\/a><br \/>\n  \u00a0\u00a0\u00a0\u00a0<br \/>\n  <a href=\"https:\/\/threatwatch360.com\" rel=\"nofollow\">\n    <themed-picture data-catalyst-inline=\"true\"><picture><source media=\"(prefers-color-scheme: dark)\" srcset=\"https:\/\/github.comhttps:\/\/github.com\/elementalsouls\/Claude-BugHunter\/raw\/main\/assets\/sponsors\/tw360-dark.svg\"><img decoding=\"async\" alt=\"ThreatWatch360\" src=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/raw\/main\/assets\/sponsors\/tw360-light.svg\" height=\"30\"\/><br \/>\n    <\/source><\/picture><\/themed-picture>\n  <\/a>\n<\/p>\n<hr\/>\n<p dir=\"auto\"><code>claude-bughunter<\/code> is a drop-in skill bundle for the <a href=\"https:\/\/docs.claude.com\/en\/docs\/claude-code\/skills\" rel=\"nofollow\">Claude Code skills system<\/a>. Install once and Claude Code stops being a chatbot and starts behaving like a senior bug-hunting researcher or red-team operator: it knows the techniques, the chain templates, the VRT mappings, the platform CVE chains, and the hygiene \u2014 and it stays in scope.<\/p>\n<p dir=\"auto\">Four layers stack:<\/p>\n<ul dir=\"auto\">\n<li><strong>Think<\/strong> \u2014 <code>bb-methodology<\/code> + <code>redteam-mindset<\/code>: the 5-phase non-linear workflow, critical-thinking framework, and red-team operator discipline.<\/li>\n<li><strong>Hunt webapps<\/strong> \u2014 58 <code>hunt-*<\/code> skills curated from 681 disclosed HackerOne reports: per-class detection patterns, payloads, bypass tables, and chain templates.<\/li>\n<li><strong>Hit the perimeter<\/strong> \u2014 enterprise platform chains (M365\/Entra, Okta, vCenter, SSL-VPN appliances, SharePoint, cloud IAM): current 2024\u20132026 CVE chains + post-credential escalation.<\/li>\n<li><strong>Ship it<\/strong> \u2014 <code>triage-validation<\/code> + reporting + <code>evidence-hygiene<\/code>: the 7-Question Gate, VRT-aware severity, OOS rebuttals, PII redaction, and red-team deliverables.<\/li>\n<\/ul>\n<p dir=\"auto\">All triggered automatically by topic \u2014 describe what you&#8217;re testing in plain English and the relevant skill loads. No invocation by name.<\/p>\n<hr\/>\n<p dir=\"auto\"><strong>Option A \u2014 install as a Claude Code plugin (recommended).<\/strong> From inside Claude Code:<\/p>\n<div class=\"snippet-clipboard-content notranslate position-relative overflow-auto\" data-snippet-clipboard-copy-content=\"\/plugin marketplace add elementalsouls\/Claude-BugHunter&#10;\/plugin install claude-bughunter@elementalsouls\">\n<pre lang=\"text\" class=\"notranslate\"><code>\/plugin marketplace add elementalsouls\/Claude-BugHunter\n\/plugin install claude-bughunter@elementalsouls\n<\/code><\/pre>\n<\/div>\n<p dir=\"auto\">All 83 skills + 15 commands load namespaced under <code>claude-bughunter:<\/code> and update when you bump the plugin version \u2014 no files copied into <code>~\/.claude\/<\/code>.<\/p>\n<p dir=\"auto\"><strong>Option B \u2014 copy install (no plugin system \/ pin to a clone):<\/strong><\/p>\n<div class=\"highlight highlight-source-shell notranslate position-relative overflow-auto\" dir=\"auto\" data-snippet-clipboard-copy-content=\"git clone https:\/\/github.com\/elementalsouls\/Claude-BugHunter.git&#10;cd Claude-BugHunter\">\n<pre>git clone https:\/\/github.com\/elementalsouls\/Claude-BugHunter.git\n<span class=\"pl-c1\">cd<\/span> Claude-BugHunter<\/pre>\n<\/div>\n<div class=\"highlight highlight-source-shell notranslate position-relative overflow-auto\" dir=\"auto\" data-snippet-clipboard-copy-content=\"# macOS \/ Linux&#10;bash scripts\/install.sh&#10;&#10;# Windows (PowerShell)&#10;pwsh .\/scripts\/install.ps1\">\n<pre><span class=\"pl-c\"><span class=\"pl-c\">#<\/span> macOS \/ Linux<\/span>\nbash scripts\/install.sh\n\n<span class=\"pl-c\"><span class=\"pl-c\">#<\/span> Windows (PowerShell)<\/span>\npwsh .\/scripts\/install.ps1<\/pre>\n<\/div>\n<p dir=\"auto\">Both copy the skills + commands into <code>~\/.claude\/<\/code> (macOS\/Linux) or <code>%USERPROFILE%\\.claude\\<\/code> (Windows) and wire the <code>hunt<\/code> engagement scaffolder.<\/p>\n<p dir=\"auto\"><strong>What each install path gives you:<\/strong><\/p>\n<p><markdown-accessiblity-table><\/p>\n<table>\n<thead>\n<tr>\n<th>Path<\/th>\n<th>83 skills + 15 slash commands<\/th>\n<th><code>cbh<\/code> CLI<\/th>\n<th><code>hunt<\/code> scaffolder<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>A \u2014 plugin<\/strong><\/td>\n<td> namespaced under <code>claude-bughunter:<\/code><\/td>\n<td> separate <code>pipx install<\/code><\/td>\n<td> clone-only<\/td>\n<\/tr>\n<tr>\n<td><strong>B \u2014 copy install<\/strong><\/td>\n<td> copied into <code>~\/.claude\/<\/code><\/td>\n<td> from the clone<\/td>\n<td> from the clone<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><\/markdown-accessiblity-table><\/p>\n<p dir=\"auto\">The plugin is the fastest path to the skills + slash commands. The terminal-native<br \/>\n<code>cbh<\/code> runner installs standalone \u2014 <code>pipx install git+https:\/\/github.com\/elementalsouls\/Claude-BugHunter<\/code><br \/>\n\u2014 so plugin users can add it without a full clone (see <a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/docs\/cbh-cli.md\"><code>cbh<\/code> CLI<\/a>).<br \/>\nThe <code>hunt<\/code> engagement scaffolder ships with the clone (Option B).<\/p>\n<p dir=\"auto\">That&#8217;s it. Open Claude Code and describe what you&#8217;re testing in plain English \u2014 the right skill loads automatically, no invocation by name:<\/p>\n<div class=\"snippet-clipboard-content notranslate position-relative overflow-auto\" data-snippet-clipboard-copy-content=\"&gt; Testing acme.com \u2014 an in-scope HackerOne target. Run recon and rank the surface.&#10;&#10;  \u27f3 loading skills: web2-recon, offensive-osint, bb-methodology \u2026&#10;    \u2192 subdomain enum (subfinder + crt.sh) \u2026 47 hosts&#10;    \u2192 live hosts (httpx) \u2026 12 \u00b7 tech fingerprint \u2026 6 distinct stacks&#10;    \u2192 ranked surface: api.acme.com (GraphQL, introspection ON)  \u2190 start here&#10;                      auth.acme.com (OAuth, SSO)               \u2190 hunt-oauth&#10;&#10;  Next: want me to probe the GraphQL introspection + OAuth redirect_uri?\">\n<pre lang=\"text\" class=\"notranslate\"><code>&gt; Testing acme.com \u2014 an in-scope HackerOne target. Run recon and rank the surface.\n\n  \u27f3 loading skills: web2-recon, offensive-osint, bb-methodology \u2026\n    \u2192 subdomain enum (subfinder + crt.sh) \u2026 47 hosts\n    \u2192 live hosts (httpx) \u2026 12 \u00b7 tech fingerprint \u2026 6 distinct stacks\n    \u2192 ranked surface: api.acme.com (GraphQL, introspection ON)  \u2190 start here\n                      auth.acme.com (OAuth, SSO)               \u2190 hunt-oauth\n\n  Next: want me to probe the GraphQL introspection + OAuth redirect_uri?\n<\/code><\/pre>\n<\/div>\n<p dir=\"auto\">\u2192 Full <a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/INSTALL.md\">Installation guide<\/a> \u00b7 <a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/USAGE.md\">Usage guide<\/a> \u00b7 <a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/docs\/skills.md\">searchable skill catalog<\/a>.<\/p>\n<blockquote>\n<p dir=\"auto\">The block above is an illustrative transcript. To record a real demo of your own session: <code>asciinema rec demo.cast<\/code> \u2192 upload to <a href=\"https:\/\/asciinema.org\" rel=\"nofollow\">asciinema.org<\/a> and drop the badge here.<\/p>\n<\/blockquote>\n<hr\/>\n<div class=\"markdown-heading\" dir=\"auto\">\n<h2 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\">Runs on multiple agent harnesses<\/h2>\n<p><a id=\"user-content-runs-on-multiple-agent-harnesses\" class=\"anchor\" aria-label=\"Permalink: Runs on multiple agent harnesses\" href=\"#runs-on-multiple-agent-harnesses\"><svg data-component=\"Octicon\" class=\"octicon octicon-link\" viewbox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hidden=\"true\"><path d=\"m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z\"\/><\/svg><\/a><\/div>\n<p dir=\"auto\"><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/assets\/harness-routing.svg\"><img decoding=\"async\" src=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/raw\/main\/assets\/harness-routing.svg\" alt=\"One install, agent harnesses \u2014 Claude Code, OpenCode, Codex CLI, Hermes Agent, Google AntiGravity\" style=\"max-width: 100%;\"\/><\/a><\/p>\n<p dir=\"auto\">The skills are plain <a href=\"https:\/\/docs.claude.com\/en\/docs\/claude-code\/skills\" rel=\"nofollow\">Agent Skills<\/a> \u2014 the same <code>SKILL.md<\/code> format that <strong>Claude Code \u00b7 OpenCode \u00b7 OpenAI Codex CLI \u00b7 Hermes Agent \u00b7 Google AntiGravity<\/strong> all load. One command installs them everywhere:<\/p>\n<div class=\"highlight highlight-source-shell notranslate position-relative overflow-auto\" dir=\"auto\" data-snippet-clipboard-copy-content=\"# macOS \/ Linux&#10;bash scripts\/install.sh --all --burp-mcp&#10;&#10;# Windows (PowerShell)&#10;pwsh .\/scripts\/install.ps1 -All -BurpMcp\">\n<pre><span class=\"pl-c\"><span class=\"pl-c\">#<\/span> macOS \/ Linux<\/span>\nbash scripts\/install.sh --all --burp-mcp\n\n<span class=\"pl-c\"><span class=\"pl-c\">#<\/span> Windows (PowerShell)<\/span>\npwsh .\/scripts\/install.ps1 -All -BurpMcp<\/pre>\n<\/div>\n<p><markdown-accessiblity-table><\/p>\n<table>\n<thead>\n<tr>\n<th>Harness<\/th>\n<th>Target Skill Directory<\/th>\n<th>Flag<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Claude Code<\/strong> (baseline)<\/td>\n<td><code>~\/.claude\/skills\/<\/code><\/td>\n<td><em>(default)<\/em><\/td>\n<\/tr>\n<tr>\n<td><strong>OpenCode<\/strong><\/td>\n<td>reads <code>~\/.claude\/skills\/<\/code> &amp; <code>~\/.agents\/skills\/<\/code><\/td>\n<td><em>(default)<\/em> \/ <code>--agents<\/code><\/td>\n<\/tr>\n<tr>\n<td><strong>OpenAI Codex CLI<\/strong><\/td>\n<td><code>~\/.agents\/skills\/<\/code><\/td>\n<td><code>--agents<\/code><\/td>\n<\/tr>\n<tr>\n<td><strong>Hermes Agent<\/strong><\/td>\n<td><code>~\/.hermes\/skills\/<\/code><\/td>\n<td><code>--hermes<\/code><\/td>\n<\/tr>\n<tr>\n<td><strong>Google AntiGravity<\/strong><\/td>\n<td><code>~\/.gemini\/config\/skills\/<\/code><\/td>\n<td><code>--antigravity<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><\/markdown-accessiblity-table><\/p>\n<p dir=\"auto\"><code>--all<\/code> (<code>-All<\/code>) detects installed harnesses and copies skills to each harness&#8217;s path (<code>~\/.claude\/skills<\/code>, <code>~\/.agents\/skills<\/code>, <code>~\/.hermes\/skills<\/code>, <code>~\/.gemini\/config\/skills<\/code>); <code>--burp-mcp<\/code> (<code>-BurpMcp<\/code>) wires the Burp MCP server into each. The full <em>knowledge<\/em> layer ports to all five \u2014 the slash commands and <code>\/hunt<\/code> engine stay Claude-Code-only by design.<\/p>\n<p dir=\"auto\">\u2192 <a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/docs\/multi-harness.md\">Multi-harness guide<\/a><\/p>\n<hr\/>\n<p><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/stargazers\">\n <themed-picture data-catalyst-inline=\"true\"><picture><source media=\"(prefers-color-scheme: dark)\" srcset=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/raw\/main\/assets\/star-history-dark.svg\"><source media=\"(prefers-color-scheme: light)\" srcset=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/raw\/main\/assets\/star-history-light.svg\"><img decoding=\"async\" alt=\"Star history chart for Claude-BugHunter\" src=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/raw\/main\/assets\/star-history-light.svg\" width=\"840\"\/><br \/>\n <\/source><\/source><\/picture><\/themed-picture>\n<\/a><\/p>\n<p dir=\"auto\"><sub>Chart is self-hosted \u2014 regenerate with <code>python3 scripts\/gen_star_history.py<\/code> (needs <code>gh auth login<\/code>).<br \/>\nRefreshes automatically each day via <code>.github\/workflows\/star-history.yml<\/code>.<\/sub><\/p>\n<hr\/>\n<div class=\"markdown-heading\" dir=\"auto\">\n<h2 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\">Scope \u2014 what this bundle is for, and what it isn&#8217;t<\/h2>\n<p><a id=\"user-content-scope--what-this-bundle-is-for-and-what-it-isnt\" class=\"anchor\" aria-label=\"Permalink: Scope \u2014 what this bundle is for, and what it isn't\" href=\"#scope--what-this-bundle-is-for-and-what-it-isnt\"><svg data-component=\"Octicon\" class=\"octicon octicon-link\" viewbox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hidden=\"true\"><path d=\"m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z\"\/><\/svg><\/a><\/div>\n<p dir=\"auto\">This bundle covers the <strong>external attack surface<\/strong> \u2014 anything reachable from the internet without first compromising an internal endpoint.<\/p>\n<ul dir=\"auto\">\n<li><strong>Bug bounty hunting<\/strong> \u2014 web apps, APIs, SaaS, GraphQL, OAuth, JWT, file upload, IDOR, SSRF, RCE chains<\/li>\n<li><strong>Web application pentesting<\/strong> \u2014 full hunt-* coverage of OWASP-mapped bug classes + discipline rules<\/li>\n<li><strong>External red-team engagements<\/strong> \u2014 initial-access against internet-facing enterprise estate: M365 \/ Entra ID, Okta-as-IdP, SharePoint on-prem (ToolShell + legacy SOAP), VMware vCenter \/ Workspace ONE, SSL VPN appliances (Cisco \/ Fortinet \/ Citrix \/ Palo Alto \/ Pulse \/ SonicWall \/ F5), Android APK red-team, supply-chain recon<\/li>\n<li><strong>Cloud misconfig + post-credential escalation<\/strong> \u2014 public S3, IMDS chains, STS AssumeRole, cross-account confused-deputy<\/li>\n<li><strong>Recon + OSINT<\/strong> \u2014 subdomain enum, identity-fabric mapping, certificate transparency, JS analysis, secret scanning<\/li>\n<li><strong>Reporting<\/strong> \u2014 H1, Bugcrowd (VRT-aware), Intigriti, Immunefi, plus client-facing red-team deliverable format<\/li>\n<\/ul>\n<div class=\"markdown-heading\" dir=\"auto\">\n<h3 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\">Out of scope (deliberate \u2014 not gaps, design decisions)<\/h3>\n<p><a id=\"user-content-out-of-scope-deliberate--not-gaps-design-decisions\" class=\"anchor\" aria-label=\"Permalink: Out of scope (deliberate \u2014 not gaps, design decisions)\" href=\"#out-of-scope-deliberate--not-gaps-design-decisions\"><svg data-component=\"Octicon\" class=\"octicon octicon-link\" viewbox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hidden=\"true\"><path d=\"m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z\"\/><\/svg><\/a><\/div>\n<ul dir=\"auto\">\n<li><strong>Internal Active Directory attacks<\/strong> \u2014 BloodHound, Kerberoasting, ASREProast, DCSync, Pass-the-Hash, AD CS abuse, ntlmrelayx, Responder, PetitPotam, etc. Different operational risk profile; needs different tooling and judgment. <strong>Future bundle, not this one.<\/strong><\/li>\n<li><strong>C2 frameworks<\/strong> \u2014 Cobalt Strike, Sliver, Mythic, Havoc, BRC4 tradecraft. Out of scope for external-only engagement model.<\/li>\n<li><strong>Post-exploit \/ persistence \/ lateral<\/strong> \u2014 Mimikatz\/comsvcs LSASS dumping, golden\/silver tickets, named-pipe impersonation, persistence (registry, scheduled tasks, WMI events, COM hijacking), token theft. These start after the perimeter has already broken \u2014 different bundle territory.<\/li>\n<li><strong>Evasion<\/strong> \u2014 AMSI bypass, ETW patching, AV\/EDR bypass. Tied to C2 tradecraft above.<\/li>\n<li><strong>iOS pentesting \/ hardware \/ RF \/ ICS<\/strong> \u2014 out of scope by design.<\/li>\n<li><strong>Binary exploitation \/ kernel pwn \/ browser internals<\/strong> \u2014 different skill universe.<\/li>\n<\/ul>\n<p dir=\"auto\">If you&#8217;re running an internal red team that includes domain-takeover chains via Kerberos or lateral movement, <strong>this bundle won&#8217;t help you in those phases<\/strong> \u2014 and we&#8217;d rather say that up front than have you find out mid-engagement. The external surface handoff to internal-RT tooling (Impacket, NetExec, CrackMapExec, Rubeus, Certify, BloodHound) is intentionally outside our scope. <strong>Coverage for internal AD and post-exploit may come in a future update.<\/strong><\/p>\n<hr\/>\n<p dir=\"auto\"><strong>83 skills<\/strong>, auto-loaded by topic \u2014 no invocation by name. Coverage across the external attack surface:<\/p>\n<p><markdown-accessiblity-table><\/p>\n<table>\n<thead>\n<tr>\n<th>Category<\/th>\n<th>#<\/th>\n<th>Examples<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Hunt \u2014 web app vuln classes<\/td>\n<td>58<\/td>\n<td>XSS, SQLi, SSRF, IDOR, LFI, SSTI, XXE, CSRF, CORS, open-redirect, SharePoint, ASP.NET\/NTLM<\/td>\n<\/tr>\n<tr>\n<td>Enterprise platform attack \u2605<\/td>\n<td>10<\/td>\n<td>M365\/Entra, Okta, cloud-IAM-deep, vCenter, enterprise VPN, APK\/iOS red-team pipelines, supply-chain recon<\/td>\n<\/tr>\n<tr>\n<td>Reporting &amp; validation<\/td>\n<td>6<\/td>\n<td>triage-validation, evidence-hygiene, report-writing, bugcrowd-reporting<\/td>\n<\/tr>\n<tr>\n<td>Recon &amp; OSINT<\/td>\n<td>5<\/td>\n<td>web2-recon, offensive-osint, osint-methodology, recon-scope-triage<\/td>\n<\/tr>\n<tr>\n<td>Methodology &amp; mindset<\/td>\n<td>4<\/td>\n<td>bb-methodology, bug-bounty, redteam-mindset, bb-local-toolkit<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><\/markdown-accessiblity-table><\/p>\n<p dir=\"auto\">Full searchable catalog \u2192 <strong><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/docs\/skills.md\">docs\/skills.md<\/a><\/strong>. Also ships <strong>15 slash commands<\/strong> (<code>\/hunt<\/code>, <code>\/recon<\/code>, <code>\/report<\/code>, \u2026) and a deterministic <strong>engagement engine<\/strong> (<code>engine\/<\/code>) that maps a target&#8217;s attack surface and routes each finding to the skill that handles it.<\/p>\n<hr\/>\n<p dir=\"auto\">A 6-phase, non-linear workflow \u2014 <strong>recon \u2192 map &amp; rank \u2192 hunt \u2192 validate \u2192 report<\/strong> \u2014 with scope enforced in code and a <strong>7-Question Gate<\/strong> before anything is submitted. Two ways to drive it:<\/p>\n<ul dir=\"auto\">\n<li><strong>Plain English<\/strong> \u2014 describe what you&#8217;re testing and the relevant skill loads automatically.<\/li>\n<li><strong><code>\/hunt<\/code> scaffold + <code>cbh<\/code> CLI<\/strong> \u2014 engagement-folder structure, state, and orchestration.<\/li>\n<\/ul>\n<p dir=\"auto\">\u2192 <a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/USAGE.md\">Usage guide &amp; worked example<\/a> \u00b7 <a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/docs\/architecture.md\">6-phase architecture &amp; skill-to-phase map<\/a> \u00b7 <a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/docs\/cbh-cli.md\"><code>cbh<\/code> CLI<\/a><\/p>\n<hr\/>\n<p dir=\"auto\">These skills are intended for assets you <strong>own<\/strong> or have <strong>written authorization to assess<\/strong> (bug-bounty in-scope assets, pentest engagement letters, CTF challenges, your own infrastructure).<\/p>\n<p dir=\"auto\">The skills include validation gates that auto-trigger when you point Claude at unverified third-party targets \u2014 <code>triage-validation<\/code>&#8216;s 7-Question Gate explicitly asks whether the asset is in scope (Q3) and on the program&#8217;s accepted-impact list (Q2). The <code>bugcrowd-reporting<\/code> skill includes researcher-side hygiene (Bugcrowdninja alias, account-state restoration, friendly-tester posture) that signals legitimate authorized testing to the target&#8217;s fraud team.<\/p>\n<p dir=\"auto\">The bundle explicitly <strong>excludes<\/strong>: weaponizing 0-days against unauthorized targets, post-exploitation tooling, malware development, mass-targeting infrastructure. See <a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/SECURITY.md\"><code>SECURITY.md<\/code><\/a> for the full posture.<\/p>\n<blockquote>\n<p dir=\"auto\"><strong>Heads-up \u2014 Anthropic runtime cyber safeguards.<\/strong> Anthropic&#8217;s models apply real-time safeguards that <strong>block &#8220;vulnerability exploitation or offensive security tooling development&#8221; by default<\/strong> \u2014 so even <em>authorized, in-scope<\/em> work can hit a refusal that isn&#8217;t this bundle&#8217;s doing. If you do authorized offensive security (pentest \/ bug bounty \/ red team), enroll in Anthropic&#8217;s <strong>free, application-based <a href=\"https:\/\/claude.com\/form\/cyber-use-case\" rel=\"nofollow\">Cyber Verification Program (CVP)<\/a><\/strong> to get safeguards adjusted for legitimate dual-use work. (Mass data exfiltration and ransomware development stay prohibited and are <em>not<\/em> adjustable.) Details: <a href=\"https:\/\/support.claude.com\/en\/articles\/14604842-real-time-cyber-safeguards-on-claude\" rel=\"nofollow\">Anthropic \u2014 real-time cyber safeguards<\/a>.<\/p>\n<\/blockquote>\n<div class=\"markdown-heading\" dir=\"auto\">\n<h3 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\">Why your model switched mid-session<\/h3>\n<p><a id=\"user-content-why-your-model-switched-mid-session\" class=\"anchor\" aria-label=\"Permalink: Why your model switched mid-session\" href=\"#why-your-model-switched-mid-session\"><svg data-component=\"Octicon\" class=\"octicon octicon-link\" viewbox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hidden=\"true\"><path d=\"m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z\"\/><\/svg><\/a><\/div>\n<p dir=\"auto\">Separate from refusals, and easy to miss. On <strong>Opus 5<\/strong>, a narrow set of higher-risk cyber requests \u2014<br \/>\nAnthropic names <em>exploit generation<\/em>, <em>binary-based vulnerability scanning<\/em> and <em>penetration testing<\/em> \u2014<br \/>\n<strong>fall back to Opus 4.8<\/strong> rather than being refused. You get a notice and the response is labelled with<br \/>\nthe model that answered, but in a long agentic run that is easy to scroll past, so it can look like<br \/>\nOpus 5 quietly got worse. See <a href=\"https:\/\/support.claude.com\/en\/articles\/16049681-why-claude-switched-models-in-your-conversation-with-opus-5\" rel=\"nofollow\">why Claude switched models<\/a>.<\/p>\n<p dir=\"auto\">What to do depends on what you are actually doing:<\/p>\n<p><markdown-accessiblity-table><\/p>\n<table>\n<thead>\n<tr>\n<th>Situation<\/th>\n<th>What helps<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Auditing your own code<\/strong> \u2014 reviewing a repo you own for defects<\/td>\n<td>Say so. &#8220;Defensive review of my own repo&#8221;, &#8220;check this against the OWASP Top 10&#8221;, &#8220;secure refactor to remediate&#8221; describe the work accurately and read as remediation. This is not a workaround; the work genuinely is defensive.<\/td>\n<\/tr>\n<tr>\n<td><strong>Authorized offensive work<\/strong> \u2014 live engagement, PoC for a bounty submission<\/td>\n<td>This is what the bundle is for, and the supported route is <a href=\"https:\/\/claude.com\/form\/cyber-use-case\" rel=\"nofollow\">CVP<\/a>. Do not reword an offensive engagement to look defensive to get past a classifier \u2014 enroll instead.<\/td>\n<\/tr>\n<tr>\n<td><strong>You just want the switching off<\/strong><\/td>\n<td>Settings \u2192 Capabilities disables automatic model switching.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><\/markdown-accessiblity-table><\/p>\n<p dir=\"auto\"><code>\/hunt<\/code> states the engagement frame (authorized, scope-bounded, remediable finding) on its first turn<br \/>\nfor exactly this reason \u2014 engagement context belongs in the session explicitly, not implied.<\/p>\n<hr\/>\n<p><markdown-accessiblity-table><\/p>\n<table>\n<thead>\n<tr>\n<th>Doc<\/th>\n<th>Contents<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/README.md\"><code>README.md<\/code><\/a><\/td>\n<td>This file \u2014 overview, quickstart, scope, skill summary<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/INSTALL.md\"><code>INSTALL.md<\/code><\/a><\/td>\n<td>Full setup with Burp MCP integration and optional skill regenerator<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/USAGE.md\"><code>USAGE.md<\/code><\/a><\/td>\n<td>Workflow walkthrough \u00b7 decision tree \u00b7 worked engagement example<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/docs\/architecture.md\"><code>docs\/architecture.md<\/code><\/a><\/td>\n<td>6-phase architecture \u00b7 skill-to-phase mapping \u00b7 engagement composition<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/docs\/cbh-cli.md\"><code>docs\/cbh-cli.md<\/code><\/a><\/td>\n<td><code>cbh<\/code> CLI \u2014 native runner orchestrating recon + classify + triage + report<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/docs\/cve-coverage.md\"><code>docs\/cve-coverage.md<\/code><\/a><\/td>\n<td>CISA KEV coverage snapshot \u2014 refreshed weekly via the workflow template at <code>docs\/automation\/cve-refresh.yml.template<\/code><\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/docs\/credits.md\"><code>docs\/credits.md<\/code><\/a><\/td>\n<td>Full attribution: 43 original skills + 8 vendored from upstream<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/CONTRIBUTING.md\"><code>CONTRIBUTING.md<\/code><\/a><\/td>\n<td>PR guidelines \u00b7 skill quality standards \u00b7 scope<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/SECURITY.md\"><code>SECURITY.md<\/code><\/a><\/td>\n<td>Authorized-use posture \u00b7 responsible disclosure \u00b7 what&#8217;s excluded<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/LICENSE\"><code>LICENSE<\/code><\/a><\/td>\n<td>MIT<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/NOTICE\"><code>NOTICE<\/code><\/a><\/td>\n<td>Upstream-skills attribution \u00b7 no-redistribution note<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/LICENSE-CONTENT\"><code>LICENSE-CONTENT<\/code><\/a><\/td>\n<td>CC BY 4.0 (skill methodology, wordlists, docs)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><\/markdown-accessiblity-table><\/p>\n<hr\/>\n<p dir=\"auto\">Most bug-hunting Claude setups are either too generic (one big &#8220;security&#8221; prompt) or too fragmented (you bookmark 30 disclosed reports and re-read them every engagement). Neither scales past the second target.<\/p>\n<p dir=\"auto\">This bundle was built and validated through authorized engagements that exposed different capability gaps:<\/p>\n<p dir=\"auto\"><strong>Bug-bounty engagement<\/strong> \u2014 surfaced four gaps a starter 3-skill stack could not close:<\/p>\n<ol dir=\"auto\">\n<li><strong>No hypothesis discipline<\/strong> \u2014 drafts written before validation \u2192 wasted hours, hurt validity ratio<\/li>\n<li><strong>No per-program reporting tactics<\/strong> \u2014 VRT defaults auto-downgraded P3-worthy findings to P4<\/li>\n<li><strong>No engagement coordination<\/strong> \u2014 findings, evidence, and submission IDs scattered across folders<\/li>\n<li><strong>No evidence hygiene<\/strong> \u2014 screenshots leaked cookies and victim PII<\/li>\n<\/ol>\n<p dir=\"auto\"><strong>External red-team engagement<\/strong> \u2014 exposed five additional gaps that bug-bounty defaults made worse:<\/p>\n<ol dir=\"auto\">\n<li><strong>Conservative defaults retracted real findings<\/strong> \u2014 WAPT mindset stopped tests early on defended targets where red-team continuation would have surfaced bypass chains \u2192 <code>redteam-mindset<\/code><\/li>\n<li><strong>No mid-engagement situational awareness<\/strong> \u2014 client SOC patched confirmed SQLi within 30 min; external attacker locked 14 accounts during a live test session \u2014 both invisible without explicit detection methodology \u2192 <code>mid-engagement-ir-detection<\/code><\/li>\n<li><strong>No enterprise-platform attack chains<\/strong> \u2014 M365 + Entra ID, on-prem SharePoint, Cisco SSL VPN, vCenter, and 7 Android APKs all needed current 2024-2026 CVE knowledge and platform-specific tradecraft \u2192 <code>m365-entra-attack<\/code>, <code>okta-attack<\/code>, <code>hunt-sharepoint<\/code>, <code>hunt-aspnet<\/code>, <code>hunt-ntlm-info<\/code>, <code>vmware-vcenter-attack<\/code>, <code>enterprise-vpn-attack<\/code>, <code>apk-redteam-pipeline<\/code><\/li>\n<li><strong>No client-facing deliverable format<\/strong> \u2014 bug-bounty report templates don&#8217;t fit enterprise red-team where output is a 50KB+ MD + DOCX with embedded screenshots \u2192 <code>redteam-report-template<\/code><\/li>\n<li><strong>No post-credential escalation model<\/strong> \u2014 when recon yielded credentials (AWS keys, JWTs, GCP JSON), it was unclear what they granted or how to escalate \u2192 <code>cloud-iam-deep<\/code><\/li>\n<\/ol>\n<p dir=\"auto\">The per-class <code>hunt-*<\/code> skills address gap-zero (<em>&#8220;what should I look for in webapps&#8221;<\/em>) \u2014 the original 24 codifying patterns from 681 disclosed HackerOne reports, with 20+ framework\/surface skills added by the community v3 expansion \u2014 Claude knows the actual chain templates real triagers paid for, not abstract OWASP Top 10. The enterprise-platform and red-team-tradecraft layers address what bug-bounty alone cannot: external red-team engagements against monitored enterprise targets.<\/p>\n<hr\/>\n<hr\/>\n<p align=\"center\" dir=\"auto\">\n  <a href=\"https:\/\/www.atlascloud.ai\/console\/coding-plan\" rel=\"nofollow\"><themed-picture data-catalyst-inline=\"true\"><picture><source media=\"(prefers-color-scheme: dark)\" srcset=\"https:\/\/github.comhttps:\/\/github.com\/elementalsouls\/Claude-BugHunter\/raw\/main\/assets\/sponsors\/atlas-cloud-dark.svg\"><img decoding=\"async\" alt=\"Atlas Cloud\" src=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/raw\/main\/assets\/sponsors\/atlas-cloud-light.svg\" width=\"340\"\/><br \/>\n  <\/source><\/picture><\/themed-picture><\/a>\n<\/p>\n<p dir=\"auto\"><strong><a href=\"https:\/\/www.atlascloud.ai\/console\/coding-plan\" rel=\"nofollow\">Atlas Cloud<\/a><\/strong> is a full-modal AI inference platform that gives developers a single AI API to access video generation, image generation, and LLM APIs. Instead of managing multiple vendor integrations, you connect once and get unified access to 300+ curated models across all modalities.<\/p>\n<p dir=\"auto\">Check out Atlas Cloud&#8217;s new coding plan promotion for more budget-friendly API access: <strong><a href=\"https:\/\/www.atlascloud.ai\/console\/coding-plan\" rel=\"nofollow\">https:\/\/www.atlascloud.ai\/console\/coding-plan<\/a><\/strong><\/p>\n<p align=\"center\" dir=\"auto\">\n  <a href=\"https:\/\/threatwatch360.com\" rel=\"nofollow\"><themed-picture data-catalyst-inline=\"true\"><picture><source media=\"(prefers-color-scheme: dark)\" srcset=\"https:\/\/github.comhttps:\/\/github.com\/elementalsouls\/Claude-BugHunter\/raw\/main\/assets\/sponsors\/tw360-dark.svg\"><img decoding=\"async\" alt=\"ThreatWatch360\" src=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/raw\/main\/assets\/sponsors\/tw360-light.svg\" width=\"430\"\/><br \/>\n  <\/source><\/picture><\/themed-picture><\/a>\n<\/p>\n<p dir=\"auto\"><strong><a href=\"https:\/\/threatwatch360.com\" rel=\"nofollow\">ThreatWatch360<\/a><\/strong> is an AI-powered offensive-security platform: continuous Attack Surface Management, AI-assisted penetration testing, brand protection, dark-web monitoring, and Cyber Threat Intelligence in one platform. Validated findings with proof-of-concept and business-impact prioritization \u2014 signal over alert fatigue.<\/p>\n<hr\/>\n<p dir=\"auto\">Operational tradecraft accumulated across bug-bounty engagements and authorized pentests, codified into Claude skills. Platform-agnostic \u2014 slot into any engagement workflow you already use, or none.<\/p>\n<p dir=\"auto\"><strong>Author:<\/strong> <a href=\"https:\/\/github.com\/elementalsouls\">ElementalSoul<\/a> \u00b7 GenAI Security Research<\/p>\n<p dir=\"auto\"><strong>Sister project:<\/strong> <a href=\"https:\/\/github.com\/elementalsouls\/Claude-OSINT\">Claude-OSINT<\/a> \u2014 paired skills for the recon phase that this bundle picks up after. Its two recon skills (<code>offensive-osint<\/code>, <code>osint-methodology<\/code>) are <strong>canonically maintained here<\/strong> and re-exported there, so the two are byte-identical. <strong>Installing both is safe:<\/strong> each bundle&#8217;s installer (<code>install.sh<\/code> on macOS\/Linux, <code>install.ps1<\/code> on Windows) records a manifest, the script skips re-copying an identical skill, and <code>--uninstall<\/code> keeps any skill the other bundle still owns \u2014 uninstalling one never breaks the other.<\/p>\n<p dir=\"auto\"><strong>Vendored foundation:<\/strong> <a href=\"https:\/\/github.com\/shuvonsec\/claude-bug-bounty\">shuvonsec\/claude-bug-bounty<\/a> \u2014 methodology, validation, reporting, payload library (8 of 83 skills + 15 slash commands)<\/p>\n<p dir=\"auto\"><strong>Generator tool used (not vendored):<\/strong> <a href=\"https:\/\/github.com\/shuvonsec\/public-skills-builder\">shuvonsec\/public-skills-builder<\/a> \u2014 used to scaffold per-class skills from H1 disclosed reports<\/p>\n<p dir=\"auto\"><strong>Inspirations:<\/strong><\/p>\n<p dir=\"auto\"><strong>Tool inventory:<\/strong><\/p>\n<p dir=\"auto\">This project is dual-licensed:<\/p>\n<p dir=\"auto\">To be precise about the boundary: <strong><code>*.py<\/code>, <code>*.sh<\/code>, and other source files are MIT; <code>*.md<\/code> documentation, wordlists, regex catalogs, and rubrics are CC BY 4.0.<\/strong><\/p>\n<p dir=\"auto\">Reuse the content freely \u2014 including commercially \u2014 as long as you credit <strong>Sachin Sharma \/ Claude-BugHunter<\/strong> and link back to this repository. See <a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter\/blob\/main\/NOTICE\"><code>NOTICE<\/code><\/a> for upstream-skills attribution.<\/p>\n<hr\/>\n<blockquote>\n<p dir=\"auto\"><em>&#8220;Give Claude the right skill and it stops being a chatbot. It becomes an operator.&#8221;<\/em><\/p>\n<\/blockquote>\n<\/div>\n<p><a href=\"https:\/\/github.com\/elementalsouls\/Claude-BugHunter?utm_source=tldrinfosec\">Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A self-contained Claude skill bundle for bug hunting and external red-team work \u00b7 83 skills \u00b7 15 slash commands \u00b7 681 disclosed-report patterns (433 now individually cited &amp; auditable) across 24 core vulnerability classes \u00b7 enterprise identity + infrastructure attack matrices \u00b7 engagement-folder scaffolding \u00b7 Burp MCP integration \u00b7 battle-tested across authorized red-team and bug-hunting [&hellip;]<\/p>\n","protected":false},"author":16,"featured_media":23722,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[143],"tags":[],"class_list":["post-23721","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai"],"_links":{"self":[{"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/posts\/23721","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/comments?post=23721"}],"version-history":[{"count":0,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/posts\/23721\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/media\/23722"}],"wp:attachment":[{"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/media?parent=23721"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/categories?post=23721"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scannn.com\/lv\/wp-json\/wp\/v2\/tags?post=23721"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}