Pentest Agents Bug Bounty Framework

reason-machines/security-skills/skills/pentest-agents-bug-bounty-framework

作者 reason-machines304c245fe992無授權條款11 個星標收錄於 2026年10月9日更新於 2026年10月9日儲存庫2 個月前更新

Autonomous bug bounty agent framework with 50 agents, hunt loops, exploit chains, MCP servers for platform integration and writeup search

僅含說明Security AI & Agents

AI 產生的概覽

自主漏洞賞金框架，內含狩獵代理、驗證關卡、漏洞利用鏈與平台 MCP 伺服器。

功能: 提供用於漏洞賞金狩獵的代理框架：50 個代理、26 個指令、酬載規則、用來記錄端點與發現的持久化大腦、7 問驗證關卡，以及 A→B 漏洞利用鏈建構器。它也說明兩個 MCP 伺服器，用於賞金平台整合與 writeup 檢索，並提供腳手架與安裝工具。產出包括狩獵工作流程、經驗證的發現、漏洞利用鏈，以及報告草稿或提交。
適用情境: 適用於建置或執行自主漏洞賞金工作流程，例如為專案建立工作區、同步專案範圍、依漏洞類別狩獵、驗證發現、串接漏洞利用，或準備平台提交。也適用於依漏洞類別檢索既有 writeup 或酬載。
執行需求: 需要支援代理或技能的 AI 程式開發工具（Claude Code、Codex、Gemini、Cursor、Windsurf、Copilot、OpenClaw）、Python 3 與 uv，以及 MCP 支援以執行伺服器。API 存取需要平台憑證（HackerOne 使用者名稱與權杖、Bugcrowd 電子郵件與權杖、Intigriti 權杖、YesWeHack API 金鑰）。選用的語意 writeup 檢索需要 faiss-cpu 與 sentence-transformers，以及本機 metadata.db 和 index.faiss。此技能僅為說明文件，本身不附帶指令碼。

Pentest Agents Bug Bounty Framework

Skill by ara.so — Security Skills collection.

Autonomous bug-bounty framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw. Ships 50 agents, 26 commands, 19 CLI tools, 11 skills, and 2 MCP servers (bounty platforms + writeup search). Includes 2,500 lines of concrete payloads, 7-Question Gate validation, autonomous hunt loops, A→B exploit chain building, persistent brain with endpoint tracking, and cross-IDE installer.

Installation

For Claude Code (Native)

bash

# Clone the repositorygit clone https://github.com/H-mmer/pentest-agents-suitecd pentest-agents-suite/pentest-agents
# Quick start with MCP servers (no global pip install)export HACKERONE_USERNAME=your_usernameexport HACKERONE_TOKEN=your_api_token
# Scaffold a new bounty workspaceuv run python3 tools/scaffold.py hackerone teslacd ~/bounties/hackerone-tesla
# Launch Claude Codeclaude

# Clone the repositorygit clone https://github.com/H-mmer/pentest-agents-suitecd pentest-agents-suite/pentest-agents
# Quick start with MCP servers (no global pip install)export HACKERONE_USERNAME=your_usernameexport HACKERONE_TOKEN=your_api_token
# Scaffold a new bounty workspaceuv run python3 tools/scaffold.py hackerone teslacd ~/bounties/hackerone-tesla
# Launch Claude Codeclaude

For Other AI Coding Tools

bash

# Use pre-rendered bundles directlycd pentest-agents-suite/pentest-agents/providers/codex  # or gemini, cursor, etc.codex  # or: gemini, cursor, windsurf
# OR install into your projectpython3 -m tools.installer install --targets all --scope projectpython3 -m tools.installer install --targets codex --scope global

# Use pre-rendered bundles directlycd pentest-agents-suite/pentest-agents/providers/codex  # or gemini, cursor, etc.codex  # or: gemini, cursor, windsurf
# OR install into your projectpython3 -m tools.installer install --targets all --scope projectpython3 -m tools.installer install --targets codex --scope global

Installer Commands

bash

# List installed targetspentest-agents list
# Install to specific targetspentest-agents install --targets claude_code,codex --scope globalpentest-agents install --dry-run  # Preview before installing
# Verify installationpentest-agents verify
# Uninstall (safe rollback)pentest-agents uninstall
# Regenerate provider bundlespentest-agents render --targets allpentest-agents render --check  # Check for drift

# List installed targetspentest-agents list
# Install to specific targetspentest-agents install --targets claude_code,codex --scope globalpentest-agents install --dry-run  # Preview before installing
# Verify installationpentest-agents verify
# Uninstall (safe rollback)pentest-agents uninstall
# Regenerate provider bundlespentest-agents render --targets allpentest-agents render --check  # Check for drift

MCP Servers

Bounty Platforms Server (16 Platforms)

HackerOne (full API), Bugcrowd, Intigriti, Immunefi, YesWeHack + 11 stubs.

Configuration:

bash

# HackerOne (full API support)export HACKERONE_USERNAME=your_usernameexport HACKERONE_TOKEN=your_api_token
# Bugcrowdexport BUGCROWD_EMAIL=your_emailexport BUGCROWD_TOKEN=your_token
# Intigritiexport INTIGRITI_TOKEN=your_token
# YesWeHackexport YWH_API_KEY=your_api_key

# HackerOne (full API support)export HACKERONE_USERNAME=your_usernameexport HACKERONE_TOKEN=your_api_token
# Bugcrowdexport BUGCROWD_EMAIL=your_emailexport BUGCROWD_TOKEN=your_token
# Intigritiexport INTIGRITI_TOKEN=your_token
# YesWeHackexport YWH_API_KEY=your_api_key

7 MCP Tools:

list_platforms - List all configured platforms
get_program_scope - Fetch in/out-of-scope assets
get_program_policy - Get submission rules
search_hacktivity - Find similar reports
sync_program - Download scope to local brain
draft_report - Prepare submission
submit_report - Submit to platform

Writeup Search Server (BYO Index)

Three search modes (auto-detected, graceful fallback):

Mode	Requires	Searches
FAISS (semantic)	`faiss-cpu`, `sentence-transformers`, your `metadata.db` + `index.faiss`	Your writeup corpus via vector embeddings
SQLite (keyword)	Your `metadata.db` only	Your writeup corpus via `LIKE` over text
Local (default)	Nothing	`rules/payloads.md` + shipped skills

Configuration:

bash

# Point to your index directoryexport WRITEUP_DB_DIR="$HOME/.local/share/pentest-writeups"
# OR place files in default location:# ~/.local/share/pentest-writeups/metadata.db# ~/.local/share/pentest-writeups/index.faiss (optional)

# Point to your index directoryexport WRITEUP_DB_DIR="$HOME/.local/share/pentest-writeups"
# OR place files in default location:# ~/.local/share/pentest-writeups/metadata.db# ~/.local/share/pentest-writeups/index.faiss (optional)

Build Your Own Index:

bash

cd rag-builder
# 1. Inspect the plan (dry-run, no writes)python3 build.py statuspython3 build.py ingest
# 2. Pre-flight check (probe URLs with git ls-remote)python3 build.py ingest --check-remotes
# 3. Clone + index repos from repos.yamlpython3 build.py ingest --execute
# 4. Point MCP server at the outputexport WRITEUP_DB_DIR="$PWD/data"python3 ../mcp-writeup-server/server.py --test

cd rag-builder
# 1. Inspect the plan (dry-run, no writes)python3 build.py statuspython3 build.py ingest
# 2. Pre-flight check (probe URLs with git ls-remote)python3 build.py ingest --check-remotes
# 3. Clone + index repos from repos.yamlpython3 build.py ingest --execute
# 4. Point MCP server at the outputexport WRITEUP_DB_DIR="$PWD/data"python3 ../mcp-writeup-server/server.py --test

Edit rag-builder/repos.yaml to customize the 146-entry seed list of CTF archives, bug-bounty reports, and payload collections.

4 MCP Tools:

search_writeups - Semantic/keyword search for prior art
get_writeup - Full writeup content by ID
search_techniques - Exploitation techniques by vuln class
search_payloads - Curated payloads from rules/payloads.md

Core Workflow

bash

# New program/new → /sync → /brain init → /analyze → /surface → /hunt
# Returning/resume <target> → /hunt or /autopilot
# After finding/validate → /chain → /report → /dupcheck → /submit → /learn
# Batch triage/triage  # 7-Question Gate on all findings

# New program/new → /sync → /brain init → /analyze → /surface → /hunt
# Returning/resume <target> → /hunt or /autopilot
# After finding/validate → /chain → /report → /dupcheck → /submit → /learn
# Batch triage/triage  # 7-Question Gate on all findings

Key Commands (26 Total)

In Claude Code Session

bash

# Set model and sync program/model opus/sync hackerone tesla
# Initialize brain and check status/brain init/status
# Hunt for vulnerabilities/hunt tesla.com/hunt tesla.com --vuln-class sqli/autopilot tesla.com  # Autonomous loop
# Validate findings/validate  # 7-Question Gate/chain     # Build exploit chain/triage    # Batch validate all findings
# Report submission/report/dupcheck/submit/learn     # Update brain with learnings
# Brain management/brain show endpoints/brain add endpoint https://api.tesla.com/v1/users/brain note "Found rate limit bypass in auth flow"/brain search "jwt"
# Cost tracking/cost      # Show session costs

# Set model and sync program/model opus/sync hackerone tesla
# Initialize brain and check status/brain init/status
# Hunt for vulnerabilities/hunt tesla.com/hunt tesla.com --vuln-class sqli/autopilot tesla.com  # Autonomous loop
# Validate findings/validate  # 7-Question Gate/chain     # Build exploit chain/triage    # Batch validate all findings
# Report submission/report/dupcheck/submit/learn     # Update brain with learnings
# Brain management/brain show endpoints/brain add endpoint https://api.tesla.com/v1/users/brain note "Found rate limit bypass in auth flow"/brain search "jwt"
# Cost tracking/cost      # Show session costs

Scaffold Tool

python

# Create new bounty workspaceimport subprocess
# Scaffold for HackerOne programsubprocess.run([    "uv", "run", "python3", "tools/scaffold.py",    "hackerone", "tesla"])
# Scaffold for Bugcrowd programsubprocess.run([    "uv", "run", "python3", "tools/scaffold.py",    "bugcrowd", "acme-corp"])

# Create new bounty workspaceimport subprocess
# Scaffold for HackerOne programsubprocess.run([    "uv", "run", "python3", "tools/scaffold.py",    "hackerone", "tesla"])
# Scaffold for Bugcrowd programsubprocess.run([    "uv", "run", "python3", "tools/scaffold.py",    "bugcrowd", "acme-corp"])

This generates:

~/bounties/<platform>-<program>/ directory
CLAUDE.md, AGENTS.md, .codex/, .gemini/, .cursor/ configs
.mcp.json with platform + writeup server config
.agents/skills/ with all framework skills

Agent System (50 Agents)

Key orchestrator agents:

chain-builder - Links findings into exploit chains (A→B)
correlator - Cross-references findings with brain
recon-ranker - Prioritizes attack surface
hunt-orchestrator - Coordinates active hunting
validator - 7-Question Gate compliance

Specialized hunters:

sqli-hunter, xss-hunter, ssrf-hunter
authz-hunter, jwt-hunter, idor-hunter
api-hunter, graphql-hunter, websocket-hunter

Agents inherit model via model: "inherit" frontmatter. Orchestrators dispatch to specialized agents automatically.

Configuration Files

.mcp.json (Claude Code)

json

{  "mcpServers": {    "bounty-platforms": {      "command": "uv",      "args": [        "run",        "--with", "mcp",        "python3",        "mcp-bounty-server/server.py"      ],      "env": {        "HACKERONE_USERNAME": "your_username",        "HACKERONE_TOKEN": "your_token"      }    },    "writeup-search": {      "command": "uv",      "args": [        "run",        "--with", "mcp",        "--with", "faiss-cpu",        "--with", "sentence-transformers",        "python3",        "mcp-writeup-server/server.py"      ],      "env": {        "WRITEUP_DB_DIR": "/home/user/.local/share/pentest-writeups"      }    }  }}

{  "mcpServers": {    "bounty-platforms": {      "command": "uv",      "args": [        "run",        "--with", "mcp",        "python3",        "mcp-bounty-server/server.py"      ],      "env": {        "HACKERONE_USERNAME": "your_username",        "HACKERONE_TOKEN": "your_token"      }    },    "writeup-search": {      "command": "uv",      "args": [        "run",        "--with", "mcp",        "--with", "faiss-cpu",        "--with", "sentence-transformers",        "python3",        "mcp-writeup-server/server.py"      ],      "env": {        "WRITEUP_DB_DIR": "/home/user/.local/share/pentest-writeups"      }    }  }}

cost_hook.py (Automatic Cost Tracking)

Add to Claude Code settings.json:

json

{  "hooks": {    "SubagentStop": "python3 /path/to/pentest-agents/hooks/cost_hook.py",    "Stop": "python3 /path/to/pentest-agents/hooks/cost_hook.py",    "SessionStart": "python3 /path/to/pentest-agents/hooks/welcome.py"  }}

{  "hooks": {    "SubagentStop": "python3 /path/to/pentest-agents/hooks/cost_hook.py",    "Stop": "python3 /path/to/pentest-agents/hooks/cost_hook.py",    "SessionStart": "python3 /path/to/pentest-agents/hooks/welcome.py"  }}

Logs to cost-tracking.json:

json

{  "sessions": [    {      "timestamp": "2026-05-17T10:30:00Z",      "agent": "sqli-hunter",      "input_tokens": 15000,      "output_tokens": 2500,      "cost_usd": 0.12    }  ]}

{  "sessions": [    {      "timestamp": "2026-05-17T10:30:00Z",      "agent": "sqli-hunter",      "input_tokens": 15000,      "output_tokens": 2500,      "cost_usd": 0.12    }  ]}

Brain System (Persistent Memory)

bash

# Initialize brain for target/brain init
# Add discoveries/brain add endpoint https://api.example.com/v1/users/brain add finding "JWT lacks signature verification in /auth"/brain add technique "SSRF via PDF renderer"
# Query brain/brain search "jwt"/brain show endpoints/brain show findings/brain stats
# Export for reporting/brain export findings.json

# Initialize brain for target/brain init
# Add discoveries/brain add endpoint https://api.example.com/v1/users/brain add finding "JWT lacks signature verification in /auth"/brain add technique "SSRF via PDF renderer"
# Query brain/brain search "jwt"/brain show endpoints/brain show findings/brain stats
# Export for reporting/brain export findings.json

Python API:

python

from tools.brain import Brain
brain = Brain("tesla.com")brain.init()
# Track endpointsbrain.add_endpoint("https://api.tesla.com/v1/users", {    "method": "GET",    "auth": "Bearer token",    "params": ["user_id", "include_deleted"]})
# Store findingsbrain.add_finding({    "vuln_class": "IDOR",    "severity": "high",    "endpoint": "/v1/users/{id}",    "description": "Lack of authz check allows cross-account access",    "poc": "curl -H 'Authorization: Bearer USER_A' https://api.tesla.com/v1/users/USER_B_ID"})
# Queryjwt_findings = brain.search("jwt")all_endpoints = brain.get_endpoints()stats = brain.stats()

from tools.brain import Brain
brain = Brain("tesla.com")brain.init()
# Track endpointsbrain.add_endpoint("https://api.tesla.com/v1/users", {    "method": "GET",    "auth": "Bearer token",    "params": ["user_id", "include_deleted"]})
# Store findingsbrain.add_finding({    "vuln_class": "IDOR",    "severity": "high",    "endpoint": "/v1/users/{id}",    "description": "Lack of authz check allows cross-account access",    "poc": "curl -H 'Authorization: Bearer USER_A' https://api.tesla.com/v1/users/USER_B_ID"})
# Queryjwt_findings = brain.search("jwt")all_endpoints = brain.get_endpoints()stats = brain.stats()

Payload System

Rules Engine

Framework ships rules/payloads.md with 2,500 lines of categorized payloads:

python

# Query via MCP# In Claude Code session:# Agent calls search_payloads("sqli mysql")
# Returns context-aware payloads from rules/payloads.md

# Query via MCP# In Claude Code session:# Agent calls search_payloads("sqli mysql")
# Returns context-aware payloads from rules/payloads.md

Payload categories:

SQL injection (MySQL, PostgreSQL, MSSQL, Oracle)
XSS (reflected, stored, DOM)
SSRF (cloud metadata, internal endpoints)
XXE, SSTI, command injection
JWT manipulation
GraphQL introspection/batching
NoSQL injection

Custom Payloads

Add to workspace payloads/<vuln-class>.md:

markdown

# Custom SQLi Payloads for Tesla
## Time-based blind (WAF bypass)' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -' AND SLEEP(5) AND '1'='1

# Custom SQLi Payloads for Tesla
## Time-based blind (WAF bypass)' AND (SELECT * FROM (SELECT(SLEEP(5)))a)-- -' AND SLEEP(5) AND '1'='1

Agents will query both shipped and custom payloads.

7-Question Gate (Validation)

Every finding must pass before submission:

python

# Triggered via /validate command
questions = [    "What is the exact attack vector?",    "What is the business impact?",    "Can you reproduce it 3 times?",    "Is it in scope per program policy?",    "Have you checked for duplicates?",    "Is there a clear fix recommendation?",    "Does the PoC include only test data?"]
# Agent validates each finding against all 7# Blocks submission if any answer is unclear

# Triggered via /validate command
questions = [    "What is the exact attack vector?",    "What is the business impact?",    "Can you reproduce it 3 times?",    "Is it in scope per program policy?",    "Have you checked for duplicates?",    "Is there a clear fix recommendation?",    "Does the PoC include only test data?"]
# Agent validates each finding against all 7# Blocks submission if any answer is unclear

Exploit Chain Builder

bash

# After finding multiple related issues/chain
# Agent analyzes:# 1. Finding A: SSRF in PDF renderer# 2. Finding B: Admin panel on internal IP# 3. Finding C: CSRF on admin delete user
# Builds chain:# A (SSRF) → B (access admin) → C (delete users)# Calculates combined severity: CRITICAL# Generates unified PoC

# After finding multiple related issues/chain
# Agent analyzes:# 1. Finding A: SSRF in PDF renderer# 2. Finding B: Admin panel on internal IP# 3. Finding C: CSRF on admin delete user
# Builds chain:# A (SSRF) → B (access admin) → C (delete users)# Calculates combined severity: CRITICAL# Generates unified PoC

Python API:

python

from tools.chain_builder import ChainBuilder
builder = ChainBuilder()
builder.add_finding("ssrf", {    "endpoint": "/render-pdf",    "impact": "Access internal network"})
builder.add_finding("csrf", {    "endpoint": "/admin/delete-user",    "impact": "Delete arbitrary users",    "requires": "Admin session"})
chain = builder.build()# Returns: dependency graph, combined severity, unified PoC

from tools.chain_builder import ChainBuilder
builder = ChainBuilder()
builder.add_finding("ssrf", {    "endpoint": "/render-pdf",    "impact": "Access internal network"})
builder.add_finding("csrf", {    "endpoint": "/admin/delete-user",    "impact": "Delete arbitrary users",    "requires": "Admin session"})
chain = builder.build()# Returns: dependency graph, combined severity, unified PoC

Platform Integration Examples

HackerOne

python

# Via MCP tools in agent session
# List programsprograms = await mcp.call_tool("list_platforms", {})
# Get Tesla scopescope = await mcp.call_tool("get_program_scope", {    "platform": "hackerone",    "program": "tesla"})
# Search for similar reportssimilar = await mcp.call_tool("search_hacktivity", {    "platform": "hackerone",    "query": "IDOR users endpoint",    "limit": 10})
# Submit reportreport = await mcp.call_tool("submit_report", {    "platform": "hackerone",    "program": "tesla",    "title": "IDOR in /v1/users allows cross-account access",    "severity": "high",    "description": "...",    "poc": "...",    "impact": "..."})

# Via MCP tools in agent session
# List programsprograms = await mcp.call_tool("list_platforms", {})
# Get Tesla scopescope = await mcp.call_tool("get_program_scope", {    "platform": "hackerone",    "program": "tesla"})
# Search for similar reportssimilar = await mcp.call_tool("search_hacktivity", {    "platform": "hackerone",    "query": "IDOR users endpoint",    "limit": 10})
# Submit reportreport = await mcp.call_tool("submit_report", {    "platform": "hackerone",    "program": "tesla",    "title": "IDOR in /v1/users allows cross-account access",    "severity": "high",    "description": "...",    "poc": "...",    "impact": "..."})

Bugcrowd

python

# Sync program to local brainawait mcp.call_tool("sync_program", {    "platform": "bugcrowd",    "program": "acme-corp"})
# Get submission policypolicy = await mcp.call_tool("get_program_policy", {    "platform": "bugcrowd",    "program": "acme-corp"})

# Sync program to local brainawait mcp.call_tool("sync_program", {    "platform": "bugcrowd",    "program": "acme-corp"})
# Get submission policypolicy = await mcp.call_tool("get_program_policy", {    "platform": "bugcrowd",    "program": "acme-corp"})

Autonomous Hunt Loop

bash

# Start autopilot mode/autopilot tesla.com
# Agent loop:# 1. Query writeup DB for techniques# 2. Test endpoints from brain# 3. Execute payloads from rules/# 4. Validate findings (7-Question Gate)# 5. Build exploit chains# 6. Log to brain# 7. Repeat with new techniques

# Start autopilot mode/autopilot tesla.com
# Agent loop:# 1. Query writeup DB for techniques# 2. Test endpoints from brain# 3. Execute payloads from rules/# 4. Validate findings (7-Question Gate)# 5. Build exploit chains# 6. Log to brain# 7. Repeat with new techniques

Modes:

--paranoid - Extra validation, slower
--normal - Balanced (default)
--aggressive - Fast, more false positives

Troubleshooting

MCP Server Not Starting

bash

# Test manuallycd mcp-bounty-serveruv run --with mcp python3 server.py --test
cd mcp-writeup-serveruv run --with mcp --with faiss-cpu --with sentence-transformers python3 server.py --test
# Check env varsecho $HACKERONE_TOKENecho $WRITEUP_DB_DIR
# Verify .mcp.json paths are absolutecat .mcp.json | grep command

# Test manuallycd mcp-bounty-serveruv run --with mcp python3 server.py --test
cd mcp-writeup-serveruv run --with mcp --with faiss-cpu --with sentence-transformers python3 server.py --test
# Check env varsecho $HACKERONE_TOKENecho $WRITEUP_DB_DIR
# Verify .mcp.json paths are absolutecat .mcp.json | grep command

Writeup Search Falls Back to Local

bash

# Check if metadata.db existsls -lh ~/.local/share/pentest-writeups/metadata.db
# Verify schemasqlite3 ~/.local/share/pentest-writeups/metadata.db "PRAGMA table_info(writeups);"
# Expected columns: id, title, url, content/text/body/writeup
# Test FAISS dependenciespython3 -c "import faiss; import sentence_transformers; print('OK')"

# Check if metadata.db existsls -lh ~/.local/share/pentest-writeups/metadata.db
# Verify schemasqlite3 ~/.local/share/pentest-writeups/metadata.db "PRAGMA table_info(writeups);"
# Expected columns: id, title, url, content/text/body/writeup
# Test FAISS dependenciespython3 -c "import faiss; import sentence_transformers; print('OK')"

Brain Not Persisting

bash

# Check brain directoryls -la ~/.pentest-agents/brains/
# Manually initializepython3 -c "from tools.brain import Brain; b = Brain('tesla.com'); b.init(); print(b.stats())"
# Verify permissionschmod -R u+w ~/.pentest-agents/

# Check brain directoryls -la ~/.pentest-agents/brains/
# Manually initializepython3 -c "from tools.brain import Brain; b = Brain('tesla.com'); b.init(); print(b.stats())"
# Verify permissionschmod -R u+w ~/.pentest-agents/

Cost Tracking Not Working

bash

# Verify hook is registeredcat ~/.claude/settings.json | grep hooks
# Check hook outputpython3 hooks/cost_hook.py  # Should emit JSON
# View tracking logcat cost-tracking.json | python3 -m json.tool

# Verify hook is registeredcat ~/.claude/settings.json | grep hooks
# Check hook outputpython3 hooks/cost_hook.py  # Should emit JSON
# View tracking logcat cost-tracking.json | python3 -m json.tool

Installer Conflicts

bash

# Show what would be installedpentest-agents install --dry-run --targets all
# Check for driftpentest-agents verify
# Safe rollbackpentest-agents uninstall  # Restores .pa-backup files

# Show what would be installedpentest-agents install --dry-run --targets all
# Check for driftpentest-agents verify
# Safe rollbackpentest-agents uninstall  # Restores .pa-backup files

Provider Bundle Out of Sync

bash

# Check driftpython3 -m tools.installer render --check
# Regenerate all providerspython3 -m tools.installer render --targets all
# Regenerate specific targetpython3 -m tools.installer render --targets codex

# Check driftpython3 -m tools.installer render --check
# Regenerate all providerspython3 -m tools.installer render --targets all
# Regenerate specific targetpython3 -m tools.installer render --targets codex

Cross-IDE Compatibility

Feature	Claude Code	Codex	Gemini	Cursor	Windsurf	Copilot	OpenClaw
Native agents	✅	✅	✅	Skills only	Skills only	✅ (30KB limit)	Skills only
Slash commands	✅	✅	✅	Skills	Workflows	Prompts	Skills
Rules files	✅	✅ (32KB)	✅	✅	✅ (12KB/file)	✅	✅
MCP servers	✅	✅	✅	✅	✅ (user-level)	✅	✅ (user-level)
Model inheritance	✅	Via `model_reasoning_effort`	N/A	N/A	N/A	N/A	N/A

All targets get the same 50 agents, 26 commands, 2 MCP servers — only the file format differs.

來源與署名

來源：reason-machines/security-skills位於skills/pentest-agents-bug-bounty-framework提交304c245

授權條款：無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

Pentest Agents Bug Bounty Framework

Pentest Agents Bug Bounty Framework

Installation

For Claude Code (Native)

For Other AI Coding Tools

Installer Commands

MCP Servers

Bounty Platforms Server (16 Platforms)

Writeup Search Server (BYO Index)

Core Workflow

Key Commands (26 Total)

In Claude Code Session

Scaffold Tool

Agent System (50 Agents)

Configuration Files

.mcp.json (Claude Code)

cost_hook.py (Automatic Cost Tracking)

Brain System (Persistent Memory)

Payload System

Rules Engine

Custom Payloads

7-Question Gate (Validation)

Exploit Chain Builder

Platform Integration Examples

HackerOne

Bugcrowd

Autonomous Hunt Loop

Troubleshooting

MCP Server Not Starting

Writeup Search Falls Back to Local

Brain Not Persisting

Cost Tracking Not Working

Installer Conflicts

Provider Bundle Out of Sync

Cross-IDE Compatibility

來源與署名

更多來自 reason-machines/security-skills 的技能

Vibe Pentest Ai Security Testing

Unisecurityguard Academic Whistleblower Archive

Security Detections Mcp

Security Threat Awareness

S800 Vehicle Network Security Testing

Mcp Security Hub

更多Security技能

Kyc Rules

Kyc Rules

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate