Skills

bb-local-toolkit

elementalsouls/Claude-BugHunterSecurityCoding & code review

bb-local-toolkit is a skill in elementalsouls/Claude-BugHunter, last changed 24 Aug 2026. It can touch credentials, download software, change agent settings, run shell commands, reach the network and name web addresses — read the findings before installing.

From the author
Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, ghauri); for pure orchestration/routing use the bug-bounty skill. Workflow it covers — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use when you need the local install path of a tool / wordlist / clone for a hunt, or as the full-workflow variant when operating from this local toolkit; for general routing use the bug-bounty skill. 中文触发词：漏洞赏金、安全测试、渗透测试、漏洞挖掘、信息收集、子域名枚举、XSS测试、SQL注入、SSRF、安全审计、漏洞报告

At a glance

What it can touch

How much a skill can do, not whether it is risky.

Pattern check

1 item to review

Instruction-override phrases

R23 · High · SKILL.md:1100

Commit d67cc00 · 3 Nov 2026

How the check works

Pattern check:1 item to reviewSee it

Install

Each tab says whether it installs commit d67cc00, the one we checked, or the latest version.

Read this before installing: Instruction-override phrases — SKILL.md:1100

Read SKILL.md first
MIT
Licence
5.4k
Repo stars
24 Aug 2026 (opens in a new tab)
Folder last changed
elementalsouls
Publisher
1 file
Files
d67cc00 (opens in a new tab)
Checked
3 Nov 2026

What it can touch

From the files and frontmatter at commit d67cc00. This is how much a skill can do, not whether it is risky.

Pattern check

Pattern check: 1 item to review · commit d67cc00 · 3 Nov 2026

  • R23 · HighInstruction-override phrases

    SKILL.md:1100 (opens in a new tab)
    …t.issue.body`. The body IS the prompt. HTML comments (`<!-- ignore previous instructions -->`) are invisible in GitHub UI but included in the API response and thus in the AI prompt.

We checked every text file in this skill, at commit d67cc00 on 3 Nov 2026, against 45 published patterns such as download-and-run commands, hidden text and credential access. We don't run the skill, we don't read the web pages it points to, and we can't judge everything its instructions might lead an agent to do. In published tests, pattern checks like this one missed most malicious skills. Read the skill before you install it — especially anything it asks you to download or run.

How the check worksReport an incorrect finding

Outside links we did not follow

  • https://target.com/FUZZ
  • https://TARGET/api/FUZZ
  • https://target.com/api/endpoint?FUZZ=test
  • https://target.com/api/endpoint
  • https://FUZZ.target.com
  • https://$
  • https://hackerone.com/graphql
  • https://evil.com
  • https://TARGET.firebaseio.com/.json
  • http://attacker.com/302-
Show 37 more
  • http://127.0.0.1%2523@attacker.com
  • https://target.com
  • https://target.com@evil.com
  • https://evil.com#target.com
  • https://evil.com/target.com
  • https://TARGET/redeem
  • https://sisaku-security.github.io/lint/
  • https://evil.com/$(env
  • https://evil.com/$
  • https://ATTACKER.burpcollaborator.net/$(cat
  • https://github.com/sisaku-security/agent-idea/tree/main/bugbountyreport
  • https://sisaku-security.github.io/lint/docs/advisory/
  • https://media.defcon.org/DEF%20CON%2032/
  • https://www.synacktiv.com/en/publications/github-actions-exploitation-introduction
  • https://attacker.com/reset?token=XXXX
  • https://target.com/reset?token=FUZZ
  • https://$name.s3.amazonaws.com/
  • http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
  • https://TARGET-APP.firebaseio.com/.json
  • https://TARGET-APP.firebaseio.com/test.json
  • https://TARGET:6443/api/v1/namespaces/default/pods
  • http://TARGET:2375/containers/json
  • https://hackerone.com/hacktivity
  • https://bugcrowd.com/crowdstream
  • https://www.intigriti.com/researcher/leaderboard
  • https://portswigger.net/web-security
  • https://book.hacktricks.xyz
  • https://github.com/swisskyrepo/PayloadsAllTheThings
  • https://solodit.cyfrin.io
  • https://chaos.projectdiscovery.io
  • https://github.com/danielmiessler/SecLists
  • https://github.com/KathanP19/HowToHunt
  • https://github.com/ihebski/DefaultCreds-cheat-sheet
  • https://xsshunter.trufflesecurity.com/
  • https://app.interactsh.com
  • https://github.com/shuvonsec/claude-bug-bounty.git
  • https://raw.githubusercontent.com/shuvonsec/claude-bug-bounty/main/SKILL.md

Format check

Each agent reads SKILL.md a little differently. We check the file against each one's published rules; we don't run the skill in any agent.

  • Agent Skills specFails

    The open format from agentskills.io, held to the strictest version of each rule among the agents we check.

    • Error

      The description is 1,764 characters; the limit is 1,024. D2

      Fix: Shorten it to 1,024 characters or fewer, and move detail into the body.

    • Warning

      Fields outside the spec: sources. Uploads to the Claude apps and API, and the spec's validator, reject the file; most agents ignore these fields. O1

      Fix: Delete them for a portable skill, or keep them if you only target the agents that read them.

    • Warning

      The body is 1552 lines; the spec suggests under 500. B1

      Fix: Move detailed sections into reference files and link to them from SKILL.md.

    • Warning

      The body is about 18,120 tokens (approx.); the spec suggests under 5,000. B2

      Fix: Move detail into reference files that the agent reads only when needed.

    • Note

      The first sentence of the description is 342 characters. Agents shorten long descriptions, so lead with the main job. D8

      Fix: Start with one short sentence that names the job.

    • Note

      There is no license field, so readers can't tell whether they may reuse the skill. O2

      Fix: Add license: with an SPDX name such as MIT or Apache-2.0, or the name of a bundled licence file.

  • Claude CodePasses with warnings

    Claude Code reads its own extra fields, ignores unknown ones, and still loads a skill whose frontmatter is broken, without its fields.

    • Warning

      The description comes to 1,764 characters; Claude Code's skill listing cuts each entry at 1,536. The listing keeps every skill's name, but past its budget (1% of the context window) Claude Code drops descriptions, starting with the skills used least. D5

      Fix: Put the key use case first, or move detail into the body.

    • Note

      The first sentence of the description is 342 characters. Agents shorten long descriptions, so lead with the main job. D8

      Fix: Start with one short sentence that names the job.

    • Note

      Claude Code ignores fields it doesn't know: sources. O1

      Fix: Check the spelling against Claude Code's field list, or delete them.

    • Note

      The body is 1552 lines; the spec suggests under 500. Claude Code's docs say the same. B1

      Fix: Move detailed sections into reference files and link to them from SKILL.md.

    • Note

      The body is about 18,120 tokens (approx.); the spec suggests under 5,000. After compaction Claude Code keeps only the first 5,000 tokens of a skill. B2

      Fix: Move detail into reference files that the agent reads only when needed.

  • Claude apps & API uploadFails

    Uploading to claude.ai or the Claude API, or packaging with Anthropic's script, accepts only the six spec fields and stops on anything else.

    • Error

      The description is 1,764 characters; the limit is 1,024. Anthropic's validator rejects it. D2

      Fix: Shorten it to 1,024 characters or fewer, and move detail into the body.

    • Error

      Upload and packaging fail on fields outside the spec: sources. O1

      Fix: Delete them, and keep your own data under metadata as text values.

    • Note

      The body is 1552 lines; the spec suggests under 500. Anthropic's guidance says the same. B1

      Fix: Move detailed sections into reference files and link to them from SKILL.md.

    • Note

      The body is about 18,120 tokens (approx.); the spec suggests under 5,000. Anthropic's guidance says the same. B2

      Fix: Move detail into reference files that the agent reads only when needed.

  • OpenAI (Codex & API)Fails

    Codex finds SKILL.md by its exact name and needs a description; OpenAI's Skills API checks the frontmatter against the spec and caps uploads.

    • Error

      The description is 1,764 characters; the limit is 1,024. Codex has no limit, but OpenAI's upload follows the spec. D2

      Fix: Shorten it to 1,024 characters or fewer, and move detail into the body.

    • Warning

      Fields outside the spec: sources. Codex ignores them; OpenAI doesn't say whether its upload accepts them. O1

      Fix: Delete them, or move your own data under metadata as text values.

    • Note

      The first sentence of the description is 342 characters. Agents shorten long descriptions, so lead with the main job. D8

      Fix: Start with one short sentence that names the job.

  • VS Code & CopilotPasses with warnings

    VS Code reads skills one folder below .github/skills, .claude/skills or .agents/skills and falls back to the folder name when the name is missing or differs; GitHub's Copilot docs require the exact name SKILL.md.

    • Warning

      The description is 1,764 characters; the limit is 1,024. VS Code cuts it at 1,024 characters. D2

      Fix: Shorten it to 1,024 characters or fewer, and move detail into the body.

    • Note

      VS Code ignores fields it doesn't support: sources. O1

      Fix: Delete them unless another agent you target reads them.

SKILL.md

We don't show this file's text because our check flagged hidden or instruction-override text in it.

Read SKILL.md on GitHub (opens in a new tab)

Files

1 file

PathSize
SKILL.md (opens in a new tab)73.1 KB

More from elementalsouls/Claude-BugHunter

SkillWhat it can touchPattern checkLicenceUpdated
  • Downloads software
  • Runs shell commands
  • +2 more
Pattern check: Nothing flaggedMIT18 May 2026
  • Touches credentials
  • Reaches the network
Pattern check: Nothing flaggedMIT24 Aug 2026
bug-bountyComplete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use for ANY bug bounty task — starting a new target, doing recon, hunting specific vulns, auditing source code, testing AI features, validating findings, or writing reports. 中文触发词：漏洞赏金、安全测试、渗透测试、漏洞挖掘、信息收集、子域名枚举、XSS测试、SQL注入、SSRF、安全审计、漏洞报告
  • Touches credentials
  • +5 more

Pattern check: 1 item to reviewMITUpdated 24 Aug 2026

  • Touches credentials
  • Downloads software
  • +4 more
Pattern check: 1 item to reviewMIT24 Aug 2026
bugcrowd-reportingBugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints, debug-info framing, user-enumeration with sensitive PII, theoretical-issue counter), chained-finding cross-reference patterns, target selection for QA-vs-prod programs, researcher-side hygiene (Bugcrowdninja email alias, account state restoration, friendly-tester posture). Use when filing a Bugcrowd submission, when VRT default seems wrong, when triager closes as OOS or downgrades severity, when chaining linked submissions, or when scope distinguishes production from QA. Pairs with report-writing and triage-validation.
  • Instructions only

Pattern check: Nothing flaggedMITUpdated 24 Aug 2026

  • Instructions only
Pattern check: Nothing flaggedMIT24 Aug 2026
cloud-iam-deepCloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.
  • Touches credentials
  • +3 more

Pattern check: Nothing flaggedMITUpdated 5 Jun 2026

  • Touches credentials
  • Runs shell commands
  • +2 more
Pattern check: Nothing flaggedMIT5 Jun 2026
  • Runs shell commands
  • Reaches the network
  • +1 more
Pattern check: Nothing flaggedMIT7 Jun 2026
All skills in elementalsouls/Claude-BugHunter

Other Security skills

Same category, most repo stars first.

SkillWhat it can touchPattern checkLicenceUpdated
  • Runs shell commands
Pattern check: Nothing flaggedMIT11 Aug 2026
  • Instructions only
Pattern check: Nothing flaggedMIT9 Oct 2026
  • Instructions only
Pattern check: Nothing flaggedMIT8 Oct 2026
csoSecurity audit: supported static findings; qualified profiles add reproduction and repair candidates. (gstack)

garrytan/gstack

  • Touches credentials
  • +4 more

Pattern check: Nothing flaggedMITUpdated 26 Oct 2026

  • Touches credentials
  • Runs shell commands
  • +3 more
Pattern check: Nothing flaggedMIT26 Oct 2026
  • Runs shell commands
Pattern check: Nothing flaggedMIT28 Oct 2026
  • Touches credentials
  • Runs shell commands
  • +2 more
Pattern check: Nothing flaggedMIT30 Oct 2026

Repo facts from GitHub on 3 Nov 2026. Files read at commit d67cc00.

QAI did not write these skills and is not affiliated with their authors unless a page says so. Logos and icons belong to their owners and are not a mark of approval. How we check