Claude-BugHunter

What the README says you get

• Other
  83 auto-loading skills83 skills, auto-loaded by topic — no invocation by name
• Other
  15 slash commandsAlso ships 15 slash commands (`/hunt`, `/recon`, `/report`, …)
• Other
  Disclosed-report patterns681 disclosed-report patterns (433 now individually cited & auditable)
• Other
  Web app hunt skills58 `hunt-*` skills curated from 681 disclosed HackerOne reports
• Other
  Enterprise platform chainsenterprise platform chains (M365/Entra, Okta, vCenter, SSL-VPN appliances, SharePoint, cloud IAM)
• Other
  Engagement folder scaffoldingengagement-folder scaffolding
• Other
  Burp MCP integrationBurp MCP integration
• Other
  Multi-harness installOne command installs them everywhere
• Other
  Engagement enginedeterministic **engagement engine** (`engine/`) that maps a target's attack surface
• Other
  Validation gatea **7-Question Gate** before anything is submitted
• Other
  Evidence hygiene`triage-validation` + reporting + `evidence-hygiene`
• Other
  VRT-aware severityVRT-aware severity, OOS rebuttals, PII redaction
• Other
  Recon and OSINT skillsRecon & OSINT | 5 | web2-recon, offensive-osint, osint-methodology, recon-scope-triage
• Other
  cbh CLI runnerThe terminal-native `cbh` runner installs standalone

Extracted from the kit's README by a local AI model (deepseek-flash) on Oct 12, 2026. Every item is checked against an exact README quote. A README claim is the maker's description, not something we tested.