A bug bounty agent framework for Claude Code that automates reconnaissance, vulnerability hunting and exploit chaining, with skills for analyzing recon output, running autonomous hunt loops and correlating findings into attack chains.
@h-mmerAnalyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>
@h-mmerAutonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes,…
@h-mmerManage the engagement brain. Subcommands: 'init' to set up, 'brief <target>' for pre-flight, 'status' for overview, 'exhausted…
@h-mmerBuild deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then…
@h-mmerRun the finding correlation engine to discover attack chains from individual findings.
@h-mmerCheck if a vulnerability has already been reported. Searches platform hacktivity + local findings. Usage: /dupcheck <vuln_type>…
@h-mmerFull security assessment with brain coordination. Multi-phase, skips known-exhausted areas, builds on prior knowledge.
@h-mmerActive vulnerability hunting on a target. Loads scope, reads brain, detects tech stack, runs targeted tests with concrete…
@h-mmerHunting skill for business-logic vulnerabilities (CWE-840 Business Logic Errors, CWE-841 Improper Enforcement of Behavioral…
@h-mmerHunting skill for Insecure Direct Object Reference / Broken Object Level Authorization (BOLA — OWASP API1:2023). Built from 1,117…
@h-mmerHunting skill for Information Disclosure / Sensitive Data Exposure (CWE-200 / CWE-209 / CWE-215 / CWE-538 / CWE-668 / CWE-798).…
@h-mmerAuthentication and session management testing agent. Use for login bypass, session fixation, password reset flow abuse, MFA…
@h-mmerCentral knowledge coordinator. Use BEFORE launching any other pentest agent to get context on what's already been tried. Also use…
@h-mmerBrowser automation agent for interactive web testing. Use for login flows, multi-step CSRF, stored XSS verification in other user…
@h-mmerStealth browser automation agent for targets behind Cloudflare, Akamai, Google, DataDome, or PerimeterX bot detection. Drives the…
@h-mmerMandatory browser verification for client-side findings (XSS, DOM, postMessage, prototype pollution). Takes a finding with…
@h-mmerBusiness Logic vulnerability specialist (H1 #28, CWE-840/841/639/362). Use for testing workflow bypasses, price manipulation,…
@h-mmerDeep exploit chain builder. Given bug A, recursively walks the chain graph — each confirmed link becomes the new A. No depth…
@h-mmerCloud misconfiguration scanner. Use for S3 bucket enumeration, Azure blob discovery, GCP storage checks, exposed cloud services,…
@h-mmerSecurity header and server configuration auditor. Use for HTTP security header analysis, CSP evaluation, CORS policy review, TLS…
@h-mmerFinding correlation engine. Use AFTER multiple agents have reported findings to discover attack chains. Combines individual…
@h-mmerCORS Misconfiguration specialist (H1 #58). Use for testing cross-origin resource sharing policies, origin reflection, null origin…
@h-mmerCSRF specialist (H1 #57). Use for testing state-changing actions without proper token validation, SameSite cookie bypass, and…
@h-mmerShips with pentest-agents: Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw —…
@h-mmerShips with pentest-agents: Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw —…
@h-mmerIs this you? Claim your profilePut a plugin at the top of Plugins, from $9
