Security
Plugin
agentic-bug-hunter
AI-powered bug bounty hunting toolkit that works with or without subscription.
Plugin Signal93/100Strong
maintained99
capable89
documented100
adopted79
Install
$ npx -y skills add awarexone/agentic-bug-hunter --agent claude-code
Stats
5,283
Stars
933
Forks
Active
Maintenance
Python
Language
MIT
License
1d ago
Last commit
7mo ago
Created
8h ago
Added
Repo: awarexone/agentic-bug-hunter
In this plugin
- commands
- arsenal
- autopilot
- breach-check
- bypass-403
- chain
- cloud-recon
- cors
- crlf
- dashboard
- domxss
- hunt
- intel
- jwt-scan
- llm-app-audit
- llm-redteam
- memory-gc
- nosqli
- oob
- osint-employees
- param-discover
- pickup
- poc
- portscan
- recon
- remember
- report
- sast
- scan-cves
- scope-aggregate
- scope
- screenshot
- secrets-hunt
- spray
- surface
- takeover
- token-scan
- triage
- validate
- verify
- web3-audit
- wordlist-gen
- skills
- agents
What's inside
Skill(19 skills)
/agentic-app-auditBlack-box security audit of a DEPLOYED AI agent (not the MCP server behind it) — tool-call hijacking, cross-session memory poisoning, confused-deputy via connected tools, agent-to-agent IDOR, excessive agency / unconfirmed destructive actions, and privilege compromise where the/argusArgus — the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes — CORS misconfiguration (origin reflection / null / credentialed read), CRLF & host-header injection, NoSQL injection (operator auth-bypass / $where blind), JWT attacks (alg:none //bb-methodologyUse at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection,
Command(41 commands)
/arsenalShow which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from high-signal repos. Use to bootstrap a fresh box or audit which optional capabilities are wired in. Usage: /arsenal | /arsenal <tool-name>/autopilotRun autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]/breach-checkHIBP k-anonymity check on a password wordlist. Enriches each password with its breach count, ranks DESC. Free API (no key), only first 5 chars of SHA-1 sent. Output -> <input>-ranked.txt. Usage /breach-check <wordlist> [--min-count N] [--max-count N] [--with-counts]
- /bypass-403
- /chain
- /cloud-recon
- /cors
- /crlf
- /dashboard
- /domxss
- /hunt
- /intel
- /jwt-scan
- /llm-app-audit
- /llm-redteam
- /memory-gc
- /nosqli
- /oob
- /osint-employees
- /param-discover
- /pickup
- /poc
- /portscan
- /recon
- /remember
- /report
- /sast
- /scan-cves
- /scope-aggregate
- /scope
- /screenshot
- /secrets-hunt
- /spray
- /surface
- /takeover
- /token-scan
- /triage
- /validate
- /verify
- /web3-audit
- /wordlist-gen
Agent(9 agents)
autopilotAutonomous hunt loop agent. Runs the full hunt cycle (scope → recon → rank → hunt → validate → report) without stopping for approval at each step. Configurable checkpoints (--paranoid, --normal, --yolo). Uses scope_checker.py for deterministic scope safety on every outboundchain-builderExploit chain builder. Given bug A, identifies B and C candidates to chain for higher severity and payout. Knows all major chain patterns — IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth, prompt injection→IDOR, subdomain
Badges
README
Get started (30 seconds)
uv tool install agentic-bug-hunter # install the CLI (or: pipx install agentic-bug-hunter)
bughunter setup # connect a free AI provider
Then hunt — straight from your terminal:
bughunter hunt target.com # recon → find → validate → report
…or drive it from inside Claude Code:
/hunt target.com
The CLI and AI hunting work on their own. Full recon also uses external tools (subfinder · httpx · nuclei · katana · ffuf · nmap) — install them with install_tools.sh from the repo. Output lands in ~/.bughunter/.
Trusted By Engineers At
What Is This?
Agentic Bug Hunter finds real, reportable bugs, not theoretical ones. Point it at a target and it runs recon, tests for vulnerabilities, validates findings against a strict gate, and writes a submission-ready report for HackerOne, Bugcrowd, Intigriti, or Immunefi.
It remembers everything: patterns found on one target inform the next, and sessions pick up where they left off.
Works as a Claude Code plugin, or as a fully standalone CLI (bughunter) with no subscription required.
Standalone Mode: No Subscription Required
You no longer need Claude Code, Claude Pro, or any paid AI subscription.
Install once, use the bughunter command from any terminal on your machine:
git clone https://github.com/Awarexone/Agentic-Bug-Hunter.git
cd Agentic-Bug-Hunter
./install.sh --agent standalone
Rerun the same command after pulling updates. The installer detects and
refreshes the active managed bughunter command, including older installations
under /usr/local/bin or ~/.local/bin, while preserving your saved provider
configuration in ~/.bughunter/config.json.
To uninstall the standalone command while keeping its configuration:
./uninstall.sh --agent standalone
Use --purge-config to also delete ~/.bughunter/config.json. The uninstaller
also supports claude, opencode, pi, codex, agents, and all targets.
bughunter help # show every command
bughunter setup # choose your AI provider (Ollama is free + offline)
bughunter recon target.com # map the attack surface
bughunter hunt target.com # hunt for vulnerabilities
bughunter validate "finding" # 7-Question Gate on your finding
bughunter report # write a submission-ready report
bughunter chat # interactive AI hunting shell
bughunter providers # list all available AI providers
bughunter models # list models and show the selected one
bughunter status # check which provider is active
bughunter h target.com # short alias for hunt
bughunter r target.com # short alias for recon
bughunter v "finding" # short alias for validate
Free AI Providers (auto-detected, free-first priority)
| Provider | Cost | Privacy | Speed | Get Started |
|---|---|---|---|---|
| Ollama | 100% free · runs locally | Full - stays on your machine | Fast | ollama pull qwen2.5:14b |
| Groq | Free tier available | Cloud | Very fast | console.groq.com → get API key |
| DeepSeek | Very cheap (v4-flash / v4-pro) | Cloud | Fast | platform.deepseek.com |
| Claude API | Paid | Cloud | Fast | console.anthropic.com |
| OpenAI | Paid | Cloud | Fast | platform.openai.com |
| Grok (xAI) | Paid | Cloud | Fast | console.x.ai → grok-4.5 |
| OpenRouter | Subscription / pay-as-you-go | Cloud | Fast | openrouter.ai/keys → get API key |
File tree
FAQ
agentic-bug-hunter is a Claude Code plugin with 19 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes agentic-app-audit, argus, bb-methodology. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
- What is agentic-bug-hunter?
- AI-powered bug bounty hunting toolkit that works with or without subscription.
- How do I install agentic-bug-hunter?
- Run these in Claude Code: npx -y skills add awarexone/agentic-bug-hunter --agent claude-code. Then prompt normally.
- Does agentic-bug-hunter auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.
- Is agentic-bug-hunter free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.
Is this plugin yours?
Claim it with GitHubSubmit a pluginPromote it