★ ★ ★LIVE51 SPECIALIZED SKILLS ACROSS 8 ATTACK DOMAINS · BUGGY AI·VIEW SKILLS →★ ★ ★
buggybuggy Hunter
51 Skills Active
BUGGY
buggy.hunt("https://target.com")→ [sqli] signal detectedclaude.triage(finding="blind-sqli")→ [7-gate] passed (7/7)recon.subdomains("target.com")→ [142] active assetsauth.audit_jwt(token="ey...")→ [none-alg] bypass foundbuggy.generate_report(cvss=9.8)→ [hackerone] markdown readyapi.probe_graphql("api.target.com/v1")→ [introspection] enabledm365.enum_users("target.com")→ [pw-spray] safe modemobile.decompile_apk("app.apk")→ [hardcoded-key] leakedbuggy.hunt("https://target.com")→ [sqli] signal detectedclaude.triage(finding="blind-sqli")→ [7-gate] passed (7/7)recon.subdomains("target.com")→ [142] active assetsauth.audit_jwt(token="ey...")→ [none-alg] bypass foundbuggy.generate_report(cvss=9.8)→ [hackerone] markdown readyapi.probe_graphql("api.target.com/v1")→ [introspection] enabledm365.enum_users("target.com")→ [pw-spray] safe modemobile.decompile_apk("app.apk")→ [hardcoded-key] leakedbuggy.hunt("https://target.com")→ [sqli] signal detectedclaude.triage(finding="blind-sqli")→ [7-gate] passed (7/7)recon.subdomains("target.com")→ [142] active assetsauth.audit_jwt(token="ey...")→ [none-alg] bypass foundbuggy.generate_report(cvss=9.8)→ [hackerone] markdown readyapi.probe_graphql("api.target.com/v1")→ [introspection] enabledm365.enum_users("target.com")→ [pw-spray] safe modemobile.decompile_apk("app.apk")→ [hardcoded-key] leaked
[ 01 · SYSTEM OVERVIEW ]

BUGGY ARCHITECTURE & SECURITY INTELLIGENCE

Buggy is a specialized collection of 51 production-grade Claude AI skills built from hundreds of public HackerOne and Bugcrowd disclosures.

TOTAL SKILLS
51 Skills
ATTACK DOMAINS
8 Domains
DISCLOSED PATTERNS
574+ H1 Disclosures
ENVIRONMENTS
Chat + Code
QUALITY GATE
7-Question Filter
LICENSE
MIT Open Source

How Skills Operate

Each skill is self-contained within a single SKILL.md context bundle that acts as a complete system prompt. Skills automatically load based on contextual triggers (e.g., encountering a JWT token loads the OAuth & Auth skill, or an APK path loads the mobile red team skill).

[ 02 · QUICK START ]

GETTING STARTED IN UNDER 5 MINUTES

Run bug hunts against live targets with Claude Code or perform static code review in Claude Chat.

# 1. Install Claude Code npm install -g @anthropic-ai/claude-code # 2. Clone the Buggy Skill Repository git clone https://github.com/bimoadis/Buggy.git buggy-skills cd buggy-skills # 3. Launch Claude Code & Start Hunting claude /hunt https://target.com
  • 1
    Clone the repository: Contains all 51 skills grouped by domain.
  • 2
    Launch Claude: Run claude inside the project root so skills auto-register.
  • 3
    Execute slash command: Use /hunt [target] for full pipeline or /hunt-sqli for specific attack classes.
[ 03 · INSTALLATION GUIDE ]

INSTALLATION MODES FOR CLAUDE CHAT & CODE

METHODENVIRONMENTSETUP TIMECAPABILITIES
ZIP UploadClaude Chat (Web)1 MinuteStatic analysis, code audit, report generation
Repo CloneClaude Code (CLI)2 MinutesLive HTTP requests, tool execution (nuclei/ffuf), terminal streaming
API PromptAnthropic API / SDKInstantDirect system prompt injection for automated pipelines
[ 04 · QUALITY GATE ]

THE 7-QUESTION QUALITY GATE

Every finding must clear all 7 questions before a report is written. A single "No" kills the report immediately. This guarantees zero speculative submissions and protects your program reputation.

#QUESTIONVERIFICATION CRITERIAACTION ON FAILURE
01In Scope?Target domain / wildcard matches bug bounty policyKILL — Out of scope
02Proven Exploitable?Working PoC HTTP request/response or token extractedKILL — Speculative / theoretical
03Real Impact?Demonstrates CIA impact (data leak, privilege gain, RCE)KILL — Informational / Best practice
04Reproduced Twice?Finding verified with independent clean sessionsKILL — Flaky / Transient
05Clean PoC?Minimal non-destructive payload; no spam/DoSREWRITE — Refine payload
06Duplicate Checked?Search public disclosures & known endpointsKILL — Probable duplicate
07Submit-Ready?Structured CVSS 3.1, impact narrative, and remediationREADY TO SHIP ✓
[ 05 · ENVIRONMENTS ]

CLAUDE CHAT VS CLAUDE CODE

# Use Claude Chat when: ✓ Reviewing source code repositories ✓ Drafting Bugcrowd/H1 reports and CVSS scores ✓ Analyzing complex JWT or SAML token responses # Use Claude Code when: ✓ Active subdomain enumeration and recon ✓ Live target probing via curl / HTTP tools ✓ End-to-end chained hunts with automated terminal feedback
[ 06 · REPORT ARTIFACTS ]

STANDARDIZED REPORT ARTIFACTS

Buggy outputs reports formatted specifically for HackerOne, Bugcrowd, and Intigriti triage teams.

## Vulnerability Report: [Vulnerability Title] **Target:** https://target.com/api/v1/resource **Vulnerability Class:** Blind Time-based SQL Injection (CWE-89) **CVSS 3.1:** 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) **7-Question Gate:** CLEARED (7/7) ### Steps to Reproduce: 1. Send GET request with parameter `q=1%20WAITFOR%20DELAY%20'0:0:8'` 2. Observe delayed server response of 8.4 seconds.
[ 07 · FAQ & SUPPORT ]

FREQUENTLY ASKED QUESTIONS

Do I need an API key to use Buggy?

No API keys are required to use the skills in Claude Chat or Claude Code. You simply clone the repo or upload the skill ZIP.

Can I modify the skill prompts?

Yes. Buggy is 100% open-source under the MIT license. You can edit any SKILL.md to tailor it for specific target scopes or proprietary tools.

What makes Buggy different from generic AI security prompts?

Buggy skills are derived directly from 574+ disclosed HackerOne and Bugcrowd reports, including exact real-world bypass patterns and the mandatory 7-Question Gate.