Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
Claude-BugHunter provides a technical framework for red-team engagements targeting mobile applications. It streamlines the transition from initial APK acquisition to deep analysis, integrating decompilation and secret extraction into a repeatable workflow.
Security researchers can use these skills to automate the recovery of internal API endpoints, hardcoded JWTs, and pinned certificates while utilizing Frida templates for runtime instrumentation.
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Follow the documented setup, then try a first task.
I’m using
Claude Code on macOS or Linux
Installs: Complete Claude-BugHunter bundle: all 83 skills, 15 slash commands, and the hunt scaffolder, installed into the documented user-level Claude directories. · Claude Code
Before you start
Claude Code installed from https://claude.ai/download
Python 3.9+ for the cbh CLI runner
Platform: macOS or Linux
Run from: ~/security-research/Claude-BugHunter
In a terminal, create and enter the documented checkout parent directory.
mkdir -p ~/security-research && cd ~/security-research
In the same terminal, clone the repository and enter it.
git clone https://github.com/elementalsouls/Claude-BugHunter.git
cd Claude-BugHunter
From the repository directory, run the installer in the terminal. Existing same-named skills are backed up outside the skills and commands directories.
Installs: Complete Claude-BugHunter bundle: all 83 skills, 15 slash commands, and the PowerShell hunt scaffolder, installed into the documented user-level Claude directories. · Claude Code
Before you start
Claude Code installed from https://claude.ai/download
Python 3.9+ for the cbh CLI runner
PowerShell with the documented pwsh command available
Platform: Windows
Run from: $HOME\security-research\Claude-BugHunter
In a PowerShell terminal, create and enter the documented checkout parent directory.
New-Item -ItemType Directory -Force -Path "$HOME\security-research"
cd "$HOME\security-research"
In the same PowerShell terminal, clone the repository and enter it.
git clone https://github.com/elementalsouls/Claude-BugHunter.git
cd Claude-BugHunter
From the repository directory, run the native installer in the PowerShell terminal. Existing same-named skills are backed up.
Installs: Complete Claude-BugHunter bundle for Claude Code, additionally installing its skills into ~/.agents/skills for Codex/OpenCode, ~/.hermes/skills for Hermes, and ~/.gemini/config/skills for Google AntiGravity. · Claude Code, Codex, OpenCode, Hermes, Google AntiGravity
Before you start
Claude Code installed from https://claude.ai/download
Python 3.9+ for the cbh CLI runner
Platform: macOS or Linux
Run from: ~/security-research/Claude-BugHunter
In a terminal, create and enter the documented checkout parent directory.
mkdir -p ~/security-research && cd ~/security-research
In the same terminal, clone the repository and enter it.
git clone https://github.com/elementalsouls/Claude-BugHunter.git
cd Claude-BugHunter
From the repository directory, run the all-harness installer command in the terminal.
./scripts/install.sh --all # also installs to ~/.agents/skills (Codex/OpenCode), ~/.hermes/skills (Hermes), and ~/.gemini/config/skills (AntiGravity)
The target's confirmed domains, organization identifiers, and authorized scope
Available ownership evidence for the listed assets
Use recon-scope-triage to review a small batch from my supplied recon export against the target's confirmed domains and organization identifiers. For each asset, identify concrete ownership evidence, flag unrelated same-name matches, and list anything that needs verification before testing. Work only from the supplied material.
Captured response headers or browser redirect evidence
The controlled destination domain and any existing chain evidence
Use hunt-open-redirect to review one candidate URL and its captured response or browser evidence. Identify the redirect parameter, assess whether the evidence shows navigation to my controlled domain, and distinguish a standalone redirect from any demonstrated chain. Explain what remains unverified without making new requests or attempting account takeover.
One confirmed finding from an authorized external enterprise red-team engagement
Observed facts, technical explanation, impact, remediation information, and PoC evidence
Available severity, status, CVSS score/vector, affected asset, and client formatting requirements
Use redteam-report-template to draft one finding for my external enterprise red-team client from the supplied confirmed evidence. Use Subject, Observations, Description, Impact, Recommendation, and PoC sections. Keep observations factual and the subject in plain English; include supplied severity, status, CVSS, and affected-asset details, and mark missing information rather than inventing it. Return a draft for review without sending or publishing it.
Claude
Codex
Cursor
Gemini CLI
OpenCode
Hermes
Antigravity
Cline