Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
Claude-BugHunter provides a technical framework for red-team engagements targeting mobile applications. It streamlines the transition from initial APK acquisition to deep analysis, integrating decompilation and secret extraction into a repeatable workflow.
Security researchers can use these skills to automate the recovery of internal API endpoints, hardcoded JWTs, and pinned certificates while utilizing Frida templates for runtime instrumentation.
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Installs: Complete Claude-BugHunter bundle for Claude Code, with its skills also installed for Codex, OpenCode, Hermes, and Google AntiGravity. · Claude Code, Codex, OpenCode, Hermes, Google AntiGravity
Before you start
Claude Code
Python 3.9+
macOS or Linux
Git available for the documented repository clone
The selected target agent installed on this machine
Platform: macOS or Linux
In a terminal, create the documented security-research directory and enter it.
mkdir -p ~/security-research && cd ~/security-research
In the terminal, clone the repository and enter its directory.
git clone https://github.com/elementalsouls/Claude-BugHunter.git
cd Claude-BugHunter
From the cloned repository directory, run the all-harness installer in the terminal.
./scripts/install.sh --all # also installs to ~/.agents/skills (Codex/OpenCode), ~/.hermes/skills (Hermes), and ~/.gemini/config/skills (AntiGravity)
<recon-dataset-path>: path to the supplied ASM/recon export
<target-owned-domains>: confirmed domains belonging to the target
Known official organization, publisher, repository-owner, or infrastructure identifiers
Check the repository for this skill’s setup.
Use the recon-scope-triage skill to review the ASM or recon dataset at <recon-dataset-path> before any testing. Given <target-owned-domains> and any known official organization, publisher, or infrastructure identifiers, separate assets with concrete ownership evidence from unproven or unrelated namespace-collision noise. For each retained asset, cite the ownership signal; flag every asset that remains unproven and do not test it.
Check an authorized target for common source leaks
Uses hunt-source-leak
<authorized-target-hostname>: explicitly authorized hostname without an invented example
Confirmation that the hostname and these read-only requests are in scope
Check the repository for this skill’s setup.
Use the hunt-source-leak skill's Phase 1 Quick Wins against <authorized-target-hostname>, which I confirm is explicitly in scope. Check the documented environment-file, Git, Swagger, OpenAPI, and API-doc paths, then return a concise table of responses that merit manual validation. Redact any discovered secret values and do not proceed beyond these initial read-only requests.
<finding-notes-path>: path to notes for one confirmed finding
Affected asset
Observed evidence and proof-of-concept details
Known remediation context, if available
Check the repository for this skill’s setup.
Use the redteam-report-template skill to turn the confirmed finding in <finding-notes-path> into one client-facing draft. Follow the documented Subject, Observations, Description, Impact, Recommendation, and PoC structure. Preserve uncertainty, use only supplied evidence, and leave unsupported severity or CVSS fields clearly marked for reviewer input. Produce a draft only; do not publish or convert it.
Claude
Codex
Cursor
Gemini CLI
OpenCode
Hermes
Antigravity
Cline