elementalsouls/Claude-BugHunter

What it is

claude-bughunter by Sachin Sharma — a drop-in Agent Skills bundle (83 skills, 15 slash commands) that reconfigures Claude Code to operate as a bug-hunting/red-team assistant. The summary covers the content; what it omits is the install model, cross-harness portability, and the explicit scope boundary — the things that determine whether this fits your workflow.

How it works

Skills are plain SKILL.md files that load automatically by topic — you describe the target in plain English and the relevant skill (e.g. web2-recon, hunt-oauth) loads without being invoked by name. The knowledge stacks in four layers: methodology/mindset → 58 hunt-* webapp skills → enterprise perimeter chains → triage/reporting. The page notes 433 of the 681 report patterns are now individually cited and auditable (the summary says 681 without this qualifier).

Preconditions / Affected

Claude Code is the primary target, but the knowledge layer ports to five harnesses — Claude Code, OpenCode, OpenAI Codex CLI, Hermes Agent, Google AntiGravity. Slash commands and the /hunt engine stay Claude-Code-only by design.

Scope is external attack surface only — anything reachable from the internet without first compromising an internal endpoint. Explicitly out of scope: internal Active Directory attacks (BloodHound, Kerberoasting, DCSync, etc.), C2 frameworks (Cobalt Strike, Sliver, Mythic), and post-exploit/persistence/lateral movement. If your engagement needs those, this bundle does not cover them.

What to do

Plugin install (recommended, namespaced, version-tracked, no files copied into ~/.claude/):

/plugin marketplace add elementalsouls/Claude-BugHunter
/plugin install claude-bughunter@elementalsouls

Copy install (Option B — also wires the /hunt engagement scaffolder, which ships only with the clone):

git clone https://github.com/elementalsouls/Claude-BugHunter.git
cd Claude-BugHunter
bash scripts/install.sh          # macOS / Linux
pwsh ./scripts/install.ps1       # Windows

Install to all detected harnesses plus wire the Burp MCP server into each:

bash scripts/install.sh --all --burp-mcp
pwsh ./scripts/install.ps1 -All -BurpMcp

Standalone terminal cbh runner (lets plugin users add it without a full clone):

pipx install git+https://github.com/elementalsouls/Claude-BugHunter

Caveats

The README's session output is an illustrative transcript, not a recorded demo — the page explicitly labels it as such and invites users to record their own. "Battle-tested" is the author's claim, benchmarked against public training platforms (DVWA, Juice Shop, Hacker101, testphp.vulnweb.com) plus unspecified authorized engagements; no external validation is offered.