Claude-BugHunter is a Python-based Claude Code skill bundle with 82 skills, 15 slash commands, and 681 disclosed-report patterns across 24 vulnerability classes, released in 2026 and active as of last push on 2026-08-03.
Collecting history — the radar snapshots this repo daily. The trend line appears after 3 days of data (1 so far).
What it is
claude-bughunter is a drop-in skill bundle for the Claude Code skills system. It provides 82 skills and 15 slash commands, plus an engagement scaffold and enterprise identity & infrastructure attack matrices to support bug hunting and external red-team work.
How it works
The bundle follows a 6-phase workflow: recon → map & rank → hunt → validate → report, with a 7-Question Gate before submission. It can be driven by plain English descriptions or by a /hunt scaffold plus cbh CLI. It includes an engagement engine that maps a target's attack surface and routes findings to appropriate skills.
Getting started
Quickstart options:
Option A — install as a Claude Code plugin (recommended).
/plugin marketplace add elementalsouls/Claude-BugHunter
/plugin install claude-bughunter@elementalsouls
All 82 skills + 15 commands load namespaced under claude-bughunter: and update when you bump the plugin version.
Option B — copy install (no plugin system / pin to a clone):
git clone https://github.com/elementalsouls/Claude-BugHunter.git
cd Claude-BugHunter
bash scripts/install.sh # macOS / Linux
pwsh ./scripts/install.ps1 # Windows (PowerShell)
Both copy the skills into ~/.claude/ (macOS/Linux) or %USERPROFILE%\.claude\ (Windows) and wire the hunt engagement scaffolder.
What each path provides:
- A — plugin: 82 skills + 15 slash commands, separate
pipx installforcbhCLI, no clone required. - B — copy install: 82 skills + 15 slash commands copied into user path and
cbhCLI available from the clone.
The plugin is the fastest path; the cbh runner installs standalone via:
pipx install git+https://github.com/elementalsouls/Claude-BugHunter
The hunt engagement scaffolder ships with the clone (Option B).
Then open Claude Code and describe what you’re testing in plain English to load the appropriate skills.
Recent releases
- v2.1 (2026-06-05): Second major bundle release with 51 → 71 skills, a CI gate, a docs site, and security fixes to the toolkit's own code. Added 20 new
hunt-*skills. - v2.0 (2026-05-25): Workstream A — Report-curation backfill across 11 hunt-* skills; improvements to missing surfaces, chains, and engagements.
Traction
Stars: 3290. Forks: 500. Open issues: 2.
Behind the repo
Not provided in the facts block.
Caveats
License: none listed. Created: 2026-05-05. Last push: 2026-08-03. The repository is a Python project focused on bug-hunting and red-team workflows, with an MIT LICENSE file not indicated in the facts. Documentation references multiple installation and usage guides. Security posture and authorization guidance are included in the documentation.