security-bounty-hunter
Hunt for exploitable, bounty-worthy security issues in repositories
by affaan-mFree
Description
security-bounty-hunter is an agent skill from the ECC collection by affaan-m, listed on skills.sh. It looks for exploitable security issues in a repository that are worth reporting through bug bounty programmes, rather than running a broad best-practice review. It focuses on remotely reachable vulnerabilities on attack paths a user can control, and it sets aside patterns that bounty platforms routinely reject as informative or out of scope. It applies when scanning a repository for exploitable flaws, preparing a submission for a platform such as Huntr or HackerOne, and triaging findings where the question is whether an issue would pay out, rather than whether it is theoretically unsafe. The skill lists the kinds of issue that consistently matter. It is for responsible disclosure and bounty work. A skill is a SKILL.md file of instructions that an AI agent loads when a task calls for it. It is free and open source, and the skills.sh listing shows a Socket warning, with Gen Agent Trust Hub and Snyk passing.…
Highlights
- Focuses on remotely reachable flaws
- Filters out platform-rejected patterns
- Triage for bounty value
- Prepares Huntr and HackerOne submissions
Ratings & Reviews
No ratings yet
Be the first to rate security-bounty-hunter.
People also visit
defi-amm-security
Security checklist for Solidity AMM contracts, liquidity pools, and swap flows
django-security
Django security best practices, authentication, authorization, CSRF protection
enterprise-agent-ops
Operational controls for long-lived or cloud-hosted agent systems
security-bounty-hunter FAQ
What does the security-bounty-hunter skill do?
It searches a repository for exploitable, remotely reachable vulnerabilities that would be worth reporting for a bounty.
How is it different from a general security review?
The skill is for practical discovery that pays out, not a broad best-practices review.
Which platforms does it mention?
Huntr and HackerOne, or similar bounty platforms.
How do I install it?
Run: npx skills add https://github.com/affaan-m/ecc --skill security-bounty-hunter
Is it free?
Yes. It is free and open source.
Are there security warnings?
The skills.sh listing shows Socket with a warning, while Gen Agent Trust Hub and Snyk pass.
What are the best security-bounty-hunter alternatives?
Popular alternatives to security-bounty-hunter include healthcheck, defi-amm-security and django-security. See all security-bounty-hunter alternatives