Skip to main content
affpapa.org
RU EN
skill CX Codex

pentest-agents-bug-bounty-framework — Claude Code skill: setup

A bug bounty testing setup for autonomous vulnerability discovery. It coordinates 50 specialized agents, connects findings into exploit chains, and tracks targets in a local brain.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/security-skills --skill pentest-agents-bug-bounty-framework -a claude-code
Open on GitHub

What pentest-agents-bug-bounty-framework does

This framework turns your coding assistant into an automated security hunter. It deploys 50 agents divided between coordinators (such as chain-builder or hunt-orchestrator) and specialized testers targeting SQLi, XSS, SSRF, or IDOR. The built-in brain tracks target endpoints persistently and combines isolated vulnerabilities into end-to-end exploit flows.

The tool ships with 26 slash commands, 19 CLI utilities, and 2 dedicated MCP servers. One server connects directly to platforms like HackerOne, Bugcrowd, and Intigriti to pull target scope and submit writeups. The other server looks up exploitation techniques across past bug reports using FAISS vector search, an SQLite database, or bundled payloads.

Platform integrations depend on explicit API credentials such as HACKERONE_TOKEN, and workspace scaffolding requires Python with uv. Running platform sync without these environment keys will immediately fail.

What it helps with

  • Chain isolated findings into A→B multi-stage exploits
  • Sync program scope directly from HackerOne or Bugcrowd
  • Evaluate bugs against the 7-Question Gate checklist
  • Search past writeup databases for vulnerability techniques

Example prompts for the agent

  • Pull target scope with /sync hackerone tesla and examine the attack surface
  • Validate the latest issue using /validate and build a chain via /chain
  • Start an automated vulnerability loop for the target domain: /autopilot tesla.com

How to install pentest-agents-bug-bounty-framework

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill pentest-agents-bug-bounty-framework -a claude-code

2Manually: put the files in place

~/.claude/skills/pentest-agents-bug-bounty-framework/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/pentest-agents-bug-bounty-framework/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about pentest-agents-bug-bounty-framework

How do I install pentest-agents-bug-bounty-framework in Claude Code?

Run npx skills add reason-machines/security-skills --skill pentest-agents-bug-bounty-framework -a claude-code. The skill file will be placed in ~/.claude/skills/pentest-agents-bug-bounty-framework/SKILL.md.

What does pentest-agents-bug-bounty-framework do?

It automates bug bounty workflows by orchestrating 50 specialized testing agents, organizing endpoint discoveries, and assembling multi-step exploit chains.

What are the search modes for the writeup server?

The writeup MCP server supports three modes: FAISS semantic search using embeddings, keyword matching via SQLite, and fallback search across local payload files.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set69

anthropic-cybersecurity-skills A library of 754 structured cybersecurity skills across 26 domains. Useful when your agent works through an incident or hunts for threats. CX Codex +1 1,600installs avast-premium-security-malware-analysis A skill for studying Avast Premium Security internals: behavior shield, real-time protection, malware detection. Built for educational and defensive research. CX Codex +1 1,100installs security-awareness-malicious-repository-detection Flags malicious GitHub repositories pretending to be cracked or pirated software. Helps inspect suspicious code sources before downloading. CX Codex +1 1,100installs avast-premium-security-detection This skill reviews suspicious repositories that claim to distribute cracked antivirus software. Use it for an initial malware and source-authenticity check. CX Codex +1 1,100installs wxmini-security-audit This skill inspects decompiled wxapkg bundles for leaked secrets, API endpoints, weak crypto and vulnerabilities. Run it before shipping a mini-program. CX Codex +1 1,100installs unisecurityguard-academic-whistleblower-archive GitHub-based documentation blueprint for academic employment disputes and whistleblowing. It preserves social media evidence against platform censorship. CX Codex +1 1,100installs report-malicious-repository Flags repositories that pose as antivirus or other commercial software and walks you through filing a GitHub report. CX Codex +1 1,100installs avast-security-awareness Trains your agent to flag repositories posing as antivirus tools or cracked software, and to warn you before anything gets downloaded. CX Codex +1 1,100installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor