A self-contained bundle of Claude skills and slash commands for bug bounty hunting and external red-team work, covering recon, Android APK analysis, and vulnerability reporting for Bugcrowd and HackerOne.
@elementalsoulsA set of Claude Code skills for open-source intelligence work, covering attack-surface discovery of cloud storage buckets, continuous exposure monitoring, email domain spoofability checks, secret detection, and risk scoring of recon findings for security teams.
@elementalsoulsEnd-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx…
@elementalsoulsLocal-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS…
@elementalsoulsUse at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master…
@elementalsoulsComplete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code…
@elementalsoulsBugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match…
@elementalsoulsCloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery…
@elementalsoulsOrganization-grade cloud and supply-chain attack-surface discovery: S3/GCS/Azure Blob bucket discovery via observed-name mining…
@elementalsoulsTurns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop (baseline snapshot…
@elementalsoulsRigorous, defensible email-spoofability verdict and SPF supply-chain risk analysis computed from published DNS alone. Deepens the…
@elementalsoulsExternal SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix…
@elementalsoulsEvidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask,…
@elementalsoulsFAIR-aligned exposure quantification: turns a pile of recon findings into a defensible 0-100 + A-F org risk score (Likelihood x…
@elementalsoulsRun autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable…
@elementalsoulsBuild an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns:…
@elementalsoulsActive vulnerability hunting. Two-track dispatcher — asks Red Team vs WAPT, hands off to hunt-dispatch skill and sibling…
@elementalsoulsOn-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Pulls NVD/GitHub-Advisory CVEs + bundled…
@elementalsoulsInspect or rotate the autopilot ledger JSONL files (findings.jsonl, negatives.jsonl). Caps file size and keeps N rotated backups…
@elementalsoulsPick up a previous hunt on a target — shows hunt history and untested surface from the autopilot ledger. Usage: /pickup target.com
@elementalsoulsRun full recon pipeline on a target — subdomain enum (Chaos API + subfinder), live host discovery (dnsx + httpx), URL crawl…
@elementalsoulsOptional manual note on a target or the last confirmed finding. Capture is automatic during autopilot; this is for extra context.…
@elementalsoulsWrite a submission-ready bug bounty report. Generates H1/Bugcrowd/Intigriti/Immunefi format with CVSS 3.1 score, proof of…
@elementalsoulsMandatory pre-flight scope check — verify an asset is in scope BEFORE any HTTP touch. Deterministic (deny-wins, default-deny) via…
@elementalsoulsShow ranked attack surface for a target from its recon manifest + hunt memory. Deterministic backing is `cbh surface <target>`…
@elementalsoulsMeme coin and token security scan — checks for rug pull vectors (hidden mint, honeypot, fee manipulation, LP lock bypass,…
@elementalsoulsIs this you? Claim your profilePut a plugin at the top of Plugins, from $9
