Claude-BugHunter: Embedding 83 Security Skills in Claude Code to Operate Like a Red Team

This skill bundle is designed to make Claude Code act as a senior bug hunter or red team operator, rather than a simple chat tool. It provides 83 skills and 15 slash commands, covering everything from web application vulnerability detection to enterprise platform attack chains and report generation. It is based on patterns extracted from 681 public HackerOne reports and covers 24 core vulnerability classes.

When a user describes the target in English, the relevant skills are loaded automatically. There is no need to invoke specific commands directly, as the workflow is automated from recon to vulnerability verification and evidence hygiene management. It targets externally exposed attack surfaces on the internet, such as M365, Okta, vCenter, and SSL-VPN, and includes the latest CVE chains from 2024 to 2026.

Internal Active Directory attacks and the use of C2 frameworks are intentionally excluded. Focusing on external surface attacks is the clear boundary of this bundle. In addition to Claude Code, it supports the same skill format in various agent harnesses, including OpenCode, OpenAI Codex CLI, Hermes Agent, and Google AntiGravity.

It is useful for bug bounty hunters or external red team engineers who need to systematically execute complex attack scenarios. It is also a verified tool on public learning platforms such as DVWA and OWASP Juice Shop. It is distributed under MIT and CC-BY-4.0 licenses and is immediately usable via plugin or script installation.