bug-bounty
elementalsouls/Claude-BugHunter / skills/bug-bounty
guides you from recon to report, dropping theoretical flaws , which improves: avoids rejected reports
Details
- judge’s score
- 4/10
- place
- outside the packs
- publisher
- elementalsouls
- status
- new
- pinned commit
- 3e8ae84 on GitHub (new tab)
- skill’s last commit
- Aug 24, 2026
- repo stars
- 5,182
- main type
- Other
Judgement
"For any bug bounty task" description too broad, catch-all scope (recon, AI, chains, reports). Concrete commands but mostly well known. Content truncated to a third, "Top 1%" marketing tone. Low score.
reservations
- SKILL.md truncated at 24,000 characters out of 77,458: the end (SSRF, reporting, submission checklist) was not assessed.
- Scope too vast: a single skill covers recon, AI, chains, reports and about ten vulnerability classes, diluting the context.
- Marketing tone and unsourced claims ("30% of submissions paid", "Top 1%"), to be taken with caution.
- Cited annex (skills/bb-methodology/SKILL.md) not provided: not penalized, but not verified.
- Triggering
- 1/2
- Added value
- 1/2
- Precision
- 1/2
- Scope
- 0/2
- Quality
- 1/2
Alerts
3 alerts, by category
Static scan
- critical risk
prompt-injection sentence
- info risk
dynamic code execution (in a code example, to be verified)
Network
- high risk
Pushes active scans (ffuf, nuclei, S3 brute force, WAF bypasses) without reminding to verify the written authorization for the target beyond the scope.
Original description
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi,…
added on Oct 19, 2026 · license MIT