/intel
On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Pulls NVD/GitHub-Advisory CVEs + bundled disclosed reports + hunt memory context. Usage: /intel target.com
> /plugin marketplace add elementalsouls/Claude-BugHunter > /plugin install claude-bughunter@elementalsouls
How it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/intel
Context preview
What this command does when you run it.
On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Pulls NVD/GitHub-Advisory CVEs + bundled disclosed reports + hunt memory context. Usage: /intel target.com
Command definition
intel.mdname: intel
description: On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Pulls NVD/GitHub-Advisory CVEs + bundled disclosed reports + hunt memory context. Usage: /intel target.com
/intel
Fetch actionable intelligence for a target.
What This Does
1. Looks up CVEs and advisories matching the target's tech stack (NVD + GitHub Advisory via web search; `learn.py` is used as an accelerator only if present) 2. Fetches HackerOne Hacktivity for the target (via HackerOne MCP if available) and cross-references the bundled `docs/disclosed-reports/` 3. Cross-references with hunt memory — flags untested CVEs and new endpoints 4. Outputs prioritized intel with hunt recommendations
Usage
/intel target.com
Output
INTEL: target.com
═══════════════════════════════════════
ALERTS:
[CRITICAL] CVE-2026-XXXX — Next.js middleware bypass (CVSS 9.1)
target.com runs Next.js 14.2.3 (vulnerable). Patch: 14.2.4.
→ You haven't tested this endpoint yet. Hunt candidate.
[HIGH] New feature detected: /api/v3/billing/invoices
Not in your tested_endpoints list. 3 new paths.
→ New = unreviewed. Priority hunt target.
[INFO] 2 new disclosed reports on HackerOne for target.com
→ Read for methodology insights before hunting.
MEMORY CONTEXT:
Last hunted: 2026-03-24 (2 days ago)
Tech stack: Next.js 14.2.3, GraphQL, PostgreSQL
Untested CVEs: 1 critical, 0 high
Data Sources
| Source | What | Auth required? | |---|---|---| | NVD (web) | CVEs matching tech stack | No | | GitHub Advisory (web) | Security advisories | No | | `docs/disclosed-reports/` | Bundled disclosed-report patterns | No (local) | | HackerOne Hacktivity / MCP (if connected) | Disclosed reports, program stats | No (public) | | Hunt memory | Previously tested endpoints | Local files |
> `learn.py` is an optional accelerator. If it isn't present, Claude performs the > lookups above directly — the command works without it.
Read more
name: intel description: On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Pulls NVD/GitHub-Advisory CVEs + bundled disclosed reports + hunt memory context. Usage: /intel target.com
/intel
Fetch actionable intelligence for a target.
What This Does
1. Looks up CVEs and advisories matching the target's tech stack (NVD + GitHub Advisory via web search; `learn.py` is used as an accelerator only if present) 2. Fetches HackerOne Hacktivity for the target (via HackerOne MCP if available) and cross-references the bundled `docs/disclosed-reports/` 3. Cross-references with hunt memory — flags untested CVEs and new endpoints 4. Outputs prioritized intel with hunt recommendations
Usage
/intel target.com
Output
INTEL: target.com ═══════════════════════════════════════ ALERTS: [CRITICAL] CVE-2026-XXXX — Next.js middleware bypass (CVSS 9.1) target.com runs Next.js 14.2.3 (vulnerable). Patch: 14.2.4. → You haven't tested this endpoint yet. Hunt candidate. [HIGH] New feature detected: /api/v3/billing/invoices Not in your tested_endpoints list. 3 new paths. → New = unreviewed. Priority hunt target. [INFO] 2 new disclosed reports on HackerOne for target.com → Read for methodology insights before hunting. MEMORY CONTEXT: Last hunted: 2026-03-24 (2 days ago) Tech stack: Next.js 14.2.3, GraphQL, PostgreSQL Untested CVEs: 1 critical, 0 high
Data Sources
| Source | What | Auth required? | |---|---|---| | NVD (web) | CVEs matching tech stack | No | | GitHub Advisory (web) | Security advisories | No | | `docs/disclosed-reports/` | Bundled disclosed-report patterns | No (local) | | HackerOne Hacktivity / MCP (if connected) | Disclosed reports, program stats | No (public) | | Hunt memory | Previously tested endpoints | Local files |
> `learn.py` is an optional accelerator. If it isn't present, Claude performs the > lookups above directly — the command works without it.
A self-contained Claude skill bundle for bug hunting and external red-team work · 82 skills · 15 slash commands · 681 disclosed-report patterns across 24 core vulnerability classes · enterprise identity + infrastructure attack matrices · engagement-folder
Repo: elementalsouls/Claude-BugHunter
Other commands on claude-bughunter.
- /autopilot
Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]
Open command - /chain
Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain
Open command - /hunt
Active vulnerability hunting. Two-track dispatcher — asks Red Team vs WAPT, hands off to hunt-dispatch skill and sibling commands. Usage: /hunt target.com | /hunt *.target.com | /hunt targets.txt [--vuln-class X] [--source-code P] [--chrome]
Open command - /memory-gc
Inspect or rotate the autopilot ledger JSONL files (findings.jsonl, negatives.jsonl). Caps file size and keeps N rotated backups so memory does not grow unbounded.
Open command - /pickup
Pick up a previous hunt on a target — shows hunt history and untested surface from the autopilot ledger. Usage: /pickup target.com
Open command - /recon
Run full recon pipeline on a target — subdomain enum (Chaos API + subfinder), live host discovery (dnsx + httpx), URL crawl (katana + waybackurls + gau), gf pattern classification, nuclei scan. Outputs to recon/<target>/ directory. Usage: /recon target.com
Open command