/surface
Show ranked attack surface for a target from its recon manifest + hunt memory. Deterministic backing is `cbh surface <target>` (reads recon/<target>/manifest.json); LLM layer adds ledger signal. Usage: /surface target.com
> /plugin marketplace add elementalsouls/Claude-BugHunter > /plugin install claude-bughunter@elementalsouls
How it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/surface
Context preview
What this command does when you run it.
Show ranked attack surface for a target from its recon manifest + hunt memory. Deterministic backing is `cbh surface <target>` (reads recon/<target>/manifest.json); LLM layer adds ledger signal. Usage: /surface target.com
Command definition
surface.mdname: surface
description: Show ranked attack surface for a target from its recon manifest + hunt memory. Deterministic backing is `cbh surface <target>` (reads recon/<target>/manifest.json); LLM layer adds ledger signal. Usage: /surface target.com
/surface
View the prioritized attack surface for a target.
What This Does
1. Reads the recon manifest at `recon/<target>/manifest.json` (produced by `cbh recon`) — the deterministic ranking comes from `cbh surface <target>` 2. Reads hunt memory for patterns and previously tested endpoints 3. Layers `engine/skill_map.py` (surface → bug-class → skill) + ledger signal on top of the manifest's `ranked_surface` (P1/P2/Kill) 4. Outputs P1 (start here), P2 (after P1), and Kill List (skip)
> The manifest is the recon→hunt contract — see [`docs/recon-manifest.md`](../docs/recon-manifest.md). > Run `cbh surface <target>` for the raw deterministic ranking.
Usage
/surface target.com
Prerequisites
Run `/recon target.com` first. If no recon data exists, you'll be prompted to run recon.
Output
ATTACK SURFACE: target.com
═══════════════════════════════════════
Priority 1 (start here):
1. api.target.com/v2/users/{id} — IDOR candidate
Tech: Express + PostgreSQL | First seen 12 days ago
Suggested: numeric ID swap on GET/PUT/DELETE
2. api.target.com/graphql — introspection enabled, 47 mutations
Suggested: field-level auth check on sensitive mutations
Priority 2 (after P1):
1. cdn.target.com:8443/upload — file upload endpoint
Suggested: extension bypass, magic bytes
Kill List (skip):
- static.target.com — CDN only
- docs.target.com — third-party hosted
Memory:
- Pattern from alpha.com (same tech): auth bypass via method override ($800)
- 3 endpoints tested in previous session, 5 remainRead more
name: surface description: Show ranked attack surface for a target from its recon manifest + hunt memory. Deterministic backing is `cbh surface <target>` (reads recon/<target>/manifest.json); LLM layer adds ledger signal. Usage: /surface target.com
/surface
View the prioritized attack surface for a target.
What This Does
1. Reads the recon manifest at `recon/<target>/manifest.json` (produced by `cbh recon`) — the deterministic ranking comes from `cbh surface <target>` 2. Reads hunt memory for patterns and previously tested endpoints 3. Layers `engine/skill_map.py` (surface → bug-class → skill) + ledger signal on top of the manifest's `ranked_surface` (P1/P2/Kill) 4. Outputs P1 (start here), P2 (after P1), and Kill List (skip)
> The manifest is the recon→hunt contract — see [`docs/recon-manifest.md`](../docs/recon-manifest.md). > Run `cbh surface <target>` for the raw deterministic ranking.
Usage
/surface target.com
Prerequisites
Run `/recon target.com` first. If no recon data exists, you'll be prompted to run recon.
Output
ATTACK SURFACE: target.com
═══════════════════════════════════════
Priority 1 (start here):
1. api.target.com/v2/users/{id} — IDOR candidate
Tech: Express + PostgreSQL | First seen 12 days ago
Suggested: numeric ID swap on GET/PUT/DELETE
2. api.target.com/graphql — introspection enabled, 47 mutations
Suggested: field-level auth check on sensitive mutations
Priority 2 (after P1):
1. cdn.target.com:8443/upload — file upload endpoint
Suggested: extension bypass, magic bytes
Kill List (skip):
- static.target.com — CDN only
- docs.target.com — third-party hosted
Memory:
- Pattern from alpha.com (same tech): auth bypass via method override ($800)
- 3 endpoints tested in previous session, 5 remainA self-contained Claude skill bundle for bug hunting and external red-team work · 82 skills · 15 slash commands · 681 disclosed-report patterns across 24 core vulnerability classes · enterprise identity + infrastructure attack matrices · engagement-folder
Repo: elementalsouls/Claude-BugHunter
Other commands on claude-bughunter.
- /autopilot
Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]
Open command - /chain
Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain
Open command - /hunt
Active vulnerability hunting. Two-track dispatcher — asks Red Team vs WAPT, hands off to hunt-dispatch skill and sibling commands. Usage: /hunt target.com | /hunt *.target.com | /hunt targets.txt [--vuln-class X] [--source-code P] [--chrome]
Open command - /intel
On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Pulls NVD/GitHub-Advisory CVEs + bundled disclosed reports + hunt memory context. Usage: /intel target.com
Open command - /memory-gc
Inspect or rotate the autopilot ledger JSONL files (findings.jsonl, negatives.jsonl). Caps file size and keeps N rotated backups so memory does not grow unbounded.
Open command - /pickup
Pick up a previous hunt on a target — shows hunt history and untested surface from the autopilot ledger. Usage: /pickup target.com
Open command