bb-local-toolkit

仓库创建 2026年5月5日最近提交 4 天前SkillHot 收录 20 天前

▸ 精选理由

把常用 recon 与证据收集流程打包为一套可复用操作指南，适合主动狩猎者。

▸ 风险提示

包含漏洞利用与渗透方法，存在被滥用风险，请在合法合规范围内使用。

这个 Skill 做什么

整合本地漏洞赏金工具与完整猎漏洞流程（Recon→Learn→Hunt→Report）。

把本地漏洞赏金工具和完整猎漏洞流程串起来，从 Recon→Learn→Hunt→Validate→Report 全流程跑通，同时能定位你机器上 SecLists、ffuf、trufflehog 等工具和字典的安装路径。要亲自跑本地扫描、复现或审源码时用它，比只做云端编排更能处理本地环境细节和工具依赖。

▸ 展开 SKILL.md 英文原文

Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, ghauri); for pure orchestration/routing use the bug-bounty skill. Workflow it covers — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaini

垂直行业漏洞赏金工作流工具集通用

3.1k

Stars

480

Forks

仓库内 Skill

+245

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/bb-local-toolkit/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/bb-local-toolkit/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Bug Bounty Master Workflow

Full pipeline: Recon -> Learn -> Hunt -> Validate -> Report. One skill for everything.

## THE ONLY QUESTION THAT MATTERS

> **"Can an attacker do this RIGHT NOW against a real user who has taken NO unusual actions -- and does it cause real harm (stolen money, leaked PII, account takeover, code execution)?"**
>
> If the answer is NO -- **STOP. Do not write. Do not explore further. Move on.**

### Theoretical Bug = Wasted Time. Kill These Immediately:

| Pattern | Kill Reason |
|---|---|
| "Could theoretically allow..." | Not exploitable = not a bug |
| "An attacker with X, Y, Z conditions could..." | Too many preconditions |
| "Wrong implementation but no practi

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有