Claude Code stops chatting and starts hunting

What it does

claude-bughunter is a drop-in skill bundle for the Claude Code skills system. Describe a target in plain English and the relevant skill loads automatically—no manual invocation. It layers methodology, per-class web-app hunters, enterprise perimeter attack chains, and reporting templates into a single 6-phase engagement loop.

The interesting bit

The rigor is what stands out: a built-in 7-Question Gate kills weak leads before they reach a report, and the bundle explicitly refuses to help with internal Active Directory, C2 frameworks, or post-exploit lateral movement. It treats scope as a feature, not a limitation.

Key highlights

• 51 skills auto-trigger by keyword, covering recon through report writing
• 681 disclosed HackerOne report patterns curated across vulnerability classes including injection, authorization, server-side, identity, and API bugs
• Enterprise identity and infrastructure matrices for Entra ID, Okta, SharePoint, and SSL VPN appliances
• Evidence-hygiene rules: cookie redaction, PII black-bars, and platform-specific report templates (HackerOne, Bugcrowd VRT, Intigriti, Immunefi, red-team DOCX)
• Burp MCP integration and a 6-phase workflow with a validation gate that can downgrade, kill, or chain findings

Caveats

• Strictly external-surface engagements; internal AD attacks, C2 tradecraft, post-exploit lateral movement, and binary exploitation are all deliberately out of scope
• No detection-rate benchmarks or false-positive metrics are provided, despite claims of being battle-tested on public training platforms

Verdict

Bug bounty hunters and external red-teamers who want structured methodology inside Claude Code should look here. If your work involves internal network compromise, mobile hardware, or kernel exploitation, this bundle will politely refuse to help.