A general purpose AI coding agent knows a little about everything and a lot about nothing, and security testing is one place where that vagueness hurts. A generic agent will suggest the obvious checks, miss the chaining that real bounty hunters use, and write a report nobody can act on. Claude-BugHunter exists to close that gap. It is an open source skill bundle for Claude Code that turns the agent into a specialist for external bug hunting and red team work, with 83 skills, 15 slash commands, and 681 vulnerability patterns drawn from disclosed bounty reports, all aimed at assets you actually have permission to test.
Key Takeaways
Claude-BugHunter is a free, open source skill bundle for Claude Code, created by Sachin Sharma under the ElementalSoul account, with 5,326 GitHub stars at the time of writing.
Its README lists 83 skills and 15 slash commands built around 681 patterns from disclosed reports across 24 core vulnerability classes.
It covers the external attack surface only, from recon and hunting to validation and reporting, and it refuses to be a general hacking toolkit.
A 7-Question Gate checks scope, authorization, and impact before any finding is submitted.
Install it as a Claude Code plugin in two commands, but review any plugin before installing: Anthropic warns that plugins can run code on your machine.
What Claude-BugHunter actually is
Claude-BugHunter is not a scanner and not a standalone app. It is a skill bundle, a set of instructions, workflows, and reference patterns that Claude Code follows while it works. Skills are reusable, filesystem-based resources that turn a general purpose agent into a specialist, and Claude loads one only when it is relevant to the request. The project lives at elementalsouls/Claude-BugHunter on GitHub, where its description calls it a skill bundle for bug hunting and external red team work.
Watch the 30-second repo signal: Watch the 30-second repo signal.
The bundle's own README puts the numbers plainly: 83 skills, 15 slash commands, and 681 disclosed-report patterns across 24 core vulnerability classes, with 433 of those patterns individually cited and auditable. That citation point matters more than the totals. A pattern tied to a real disclosed report can be checked, argued with, and learned from, while an invented checklist cannot. The README also credits its foundation: the bundle builds on shuvonsec/claude-bug-bounty and extends it with enterprise coverage and a full hunting workflow.
How a hunt runs
A Claude-BugHunter hunt follows six phases, and the order is the point. It starts with reconnaissance, then maps and ranks the attack surface, then hunts actively, validates what it finds, writes the report, and iterates on what the validation taught it. Skipping straight to active hunting is how testers waste time on low value targets and how they produce findings that fall apart on retest.
The skill breakdown shows where the weight sits: 58 hunt skills, 10 enterprise platform skills, 6 reporting and validation skills, 5 recon and OSINT skills, and 4 methodology and mindset skills. The enterprise set is the part most general agents cannot fake. It covers M365 and Entra, Okta, vCenter, SSL-VPN appliances, SharePoint, and cloud IAM, with CVE chains from 2024 to 2026. Those are the systems that sit on the edge of a company network, and they are exactly where external red team work lives.
Aspect | Detail |
|---|---|
Skills | 83, per the project README |
Slash commands | 15, including the hunt engine |
Vulnerability patterns | 681 from disclosed reports, across 24 core classes |
GitHub stars | 5,326 at the time of writing |
License | MIT for code, CC BY 4.0 for skill content |
Primary host | Claude Code, with wider harness support |
Built for the outside only
The most important design choice in Claude-BugHunter is what it refuses to do. It is explicitly for the external attack surface only. It deliberately excludes internal Active Directory attacks, command and control frameworks, post-exploitation and persistence, evasion, iOS pentesting, hardware, radio frequency, industrial control systems, binary exploitation, and kernel exploitation. That boundary is a feature, not a gap. Bug bounty programs and external red team engagements are scoped to what is reachable from outside, and a tool that stays inside that scope is easier to trust with a real engagement.
The same discipline shows up in the 7-Question Gate, which runs before any finding is submitted. It checks scope authorization and accepted impact, among other questions, so the agent has to confirm it is allowed to test the target and that the impact it claims is real. Skills in the bundle are for assets the user owns or has written authorization to assess. If you are learning, the README names safe practice targets instead: DVWA, OWASP Juice Shop, Hacker101, and testphp.vulnweb.com. Run it there first, not against a stranger's production site.
Install it in two commands
Installation as a Claude Code plugin takes two commands:
/plugin marketplace add elementalsouls/Claude-BugHunter /plugin install claude-bughunter@elementalsouls
On macOS or Linux you can also clone the repo and run bash scripts/install.sh. The slash commands and the /hunt engine stay Claude Code only by design, but the README claims wider harness support for the skills themselves: OpenCode, OpenAI Codex CLI, Hermes Agent, and Google AntiGravity. Burp Suite users get an MCP integration for the proxy workflow, according to independent coverage of the project from Hackers Online Club.
One warning belongs in any install guide for this kind of tool. A Claude Code plugin can execute arbitrary code on your machine with your privileges, and Claude Code's permission rules and sandbox cover the tool calls Claude makes, not the code a plugin runs by itself. Anthropic also states that it does not review third-party marketplaces, and Claude-BugHunter installs from its author's own marketplace, not Anthropic's official one. Read the plugin's code and skills before you install it, and treat it like installing software, because that is what it is.
There is one more practical caveat. Anthropic's runtime safeguards can block vulnerability exploitation or offensive security tooling by default, and the README points authorized users to Anthropic's free, application-based Cyber Verification Program. If a command is refused on an authorized target, that program, not a workaround, is the documented path.
What Claude-BugHunter does not do
Claude-BugHunter will not make you a bug hunter by itself, and it will not turn an unauthorized target into an authorized one. It does not replace judgment about scope, it does not validate a finding for you in the legal sense, and it does not cover internal networks or exploit development. It also cannot rescue a bad program: if a bounty program has a narrow scope, a slow triage team, or out of scope assets everywhere, no skill bundle fixes that. What it does is give an authorized tester a repeatable process, a pattern library grounded in real reports, and a report format that triage teams can actually use.
Why it matters
Bug bounty work has always rewarded pattern recognition: seeing the same flaw shape in a new target, chaining two medium issues into one critical one, and writing it up so the fix is obvious. Those are exactly the things a general purpose agent is bad at without guidance, because it has no memory of which patterns paid out and no workflow that forces validation before reporting. Claude-BugHunter packages that memory as skills and that workflow as a six-phase hunt, and it does it in the open, under a dual license of MIT for code and CC BY 4.0 for content.
If you do authorized security testing with Claude Code, try it on a practice target first and compare the findings with the agent alone. The difference is the whole argument: not more findings, but findings that survive validation. For a related take on giving Claude a specialist security job, read CVE MCP Server: Turn Claude Into an Automated CVE Analyst.
Read this article in Indonesian: Baca artikel ini dalam Bahasa Indonesia.
FAQ
Is Claude-BugHunter free?
Yes. It is open source, with MIT licensing for its code and CC BY 4.0 for its skill content, so you can use it, fork it, and adapt it.
Which tools does Claude-BugHunter work with?
Its slash commands and hunt engine are Claude Code only. The skills also claim support for OpenCode, OpenAI Codex CLI, Hermes Agent, and Google AntiGravity, plus a Burp Suite MCP integration.
Do I need permission to use it?
Yes. The bundle is for assets you own or have written authorization to assess, and its 7-Question Gate checks scope and impact before submission. For practice, use DVWA, OWASP Juice Shop, Hacker101, or testphp.vulnweb.com.
Does it hack internal networks?
No. It covers the external attack surface only and deliberately excludes internal Active Directory attacks, post-exploitation, persistence, and exploit development.
Is installing a Claude Code plugin safe?
Only as safe as your review of it. Anthropic warns that plugins can run arbitrary code with your privileges and that third-party marketplaces are not reviewed by Anthropic, so read the plugin before installing.