arsenal
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from high-signal repos. Use to…
Pick up a previous hunt on a target — shows hunt history, untested endpoints, and memory-informed suggestions. Usage: /pickup target.com
$ npx -y skills add shuvonsec/claude-bug-bounty --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
/pickupContext preview
What this command does when you run it.
Pick up a previous hunt on a target — shows hunt history, untested endpoints, and memory-informed suggestions. Usage: /pickup target.com
description: Pick up a previous hunt on a target — shows hunt history, untested endpoints, and memory-informed suggestions. Usage: /pickup target.com
Pick up where you left off on a target.
> **Renamed from `/resume`** — `/resume` is a reserved Claude Code command. Use `/pickup` to continue a previous hunt.
1. Reads the target profile from `hunt-memory/targets/<target>.json` 2. Shows hunt history (sessions, findings, payouts) 3. Lists untested endpoints from last recon 4. Suggests techniques based on tech stack + pattern DB 5. Asks: continue hunting or re-run recon?
/pickup target.com
PICKUP: target.com
═══════════════════════════════════════
Hunt History:
Sessions: 3
Last hunt: 2026-03-24
Total time: 2h 00m
Findings: 1 confirmed (IDOR, $1500 paid)
Untested Surface:
3 endpoints from last recon:
1. /api/v2/users/{id}/export
2. /api/v2/users/{id}/share
3. /api/v2/users/{id}/history
Memory Suggestions:
Tech stack [Next.js, GraphQL, PostgreSQL] matches 2 targets
where you found auth bypass. Try introspection → mutation pattern.
Actions:
[r] Continue hunting untested endpoints
[n] Re-run recon first (surface may have changed)
[s] Show full hunt journal for this targetNo previous hunt data for target.com. Run /recon target.com first, then /hunt target.com.
AI-powered bug bounty hunting toolkit that works with or without subscription.
Repo: shuvonsec/claude-bug-bounty
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from high-signal repos. Use to…
Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot…
HIBP k-anonymity check on a password wordlist. Enriches each password with its breach count, ranks DESC. Free API (no key), only first 5 chars of SHA-1 sent.…
Probe a 403/401 endpoint with the most-paid bypass tricks (header injection, path encoding, method swap, WAF fingerprint, vendor-specific). Wraps byp4xx when…
Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata,…
Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloud_enum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in…