Claude-BugHunter jumped onto GitHub trending in mid-November 2026 with roughly 5,900 stars on the repository — not because it is a worm like strutil-core, but because it is a large, openly documented offensive-security skill bundle for coding agents. Install it and Claude Code, Codex, or sibling harnesses gain 83 topic-triggered skills (including 58 hunt-* playbooks), Burp MCP integration, and patterns drawn from 681 disclosed bug-bounty reports. That is valuable on authorized programs; on an everyday laptop it widens what your agent knows how to attempt and what it can reach through MCP.
| Question | Short answer |
|---|---|
| Am I affected? | Only if you (or a teammate) install the plugin or run install.sh on a machine you use for coding agents |
| Is there a fix? | There is no patch — risk is scope and trust. Pin a reviewed version, read SKILL.md files, and isolate engagement hosts |
| Does data leave my machine? | The installer copies local files; your model provider still sees prompts, and Burp MCP can bridge the agent to live HTTP traffic when wired |
| Is it malware? | The repo positions itself as authorized external testing with explicit exclusions in SECURITY.md — still third-party agent instructions |
| Does Beam stop it? | Beam scans skills/MCP configs and can deny some tool calls; it does not block installs or judge legal scope |
What the bundle is
The README describes claude-bughunter as a drop-in bundle that stacks four layers:
- Think — methodology skills such as
bb-methodologyandredteam-mindset(non-linear recon → hunt → validate → report, scope discipline). - Hunt webapps — 58
hunt-*skills with detection patterns, payloads, bypass tables, and chain templates mapped to OWASP-style classes. - Hit the perimeter — enterprise chains for M365/Entra, Okta, SharePoint, vCenter, SSL VPN appliances, and cloud IAM escalation, including 2024–2026 CVE references in the maintainer’s docs.
- Ship it —
triage-validation, reporting skills, andevidence-hygiene(7-Question Gate before submission, PII redaction).
Skills are Agent Skills format (SKILL.md) — the same shape as Cloudflare’s security-audit skill and the broader agent skills supply-chain problem we have covered all year. The difference is intent and content: this bundle optimizes for live offensive testing on in-scope assets, not defensive auditing of a repo you own.
The README is explicit about deliberate out-of-scope boundaries: internal Active Directory attacks, C2 frameworks, post-exploit persistence, and evasion are not included — the author warns internal red-team phases need different tooling.
Vendoring notes matter for trust: 8 of 83 skills plus 15 slash commands trace to shuvonsec/claude-bug-bounty; additional skills were scaffolded with shuvonsec/public-skills-builder from public HackerOne disclosures. License split: MIT for Python/shell helpers, CC BY 4.0 for methodology content per the README.
How installation changes your agent
Two paths appear in the README:
Plugin path (recommended in repo docs)
/plugin marketplace add elementalsouls/Claude-BugHunter
/plugin install claude-bughunter@elementalsouls
Skills load namespaced under claude-bughunter: and update when you bump the plugin version — no files copied into ~/.claude/ per the install table.
Copy path
git clone https://github.com/elementalsouls/Claude-BugHunter.git
cd Claude-BugHunter
bash scripts/install.sh
On Windows the README uses pwsh ./scripts/install.ps1. Both copy skills and commands into ~/.claude/ (or %USERPROFILE%\.claude\) and wire the hunt engagement scaffolder. A separate cbh CLI can install via pipx install git+https://github.com/elementalsouls/Claude-BugHunter for terminal-native orchestration.
Multi-harness install
bash scripts/install.sh --all --burp-mcp detects Claude Code, OpenCode, Codex (~/.agents/skills/), Hermes, and AntiGravity paths per the README’s harness table. --burp-mcp writes Burp Suite MCP server entries into each harness’s MCP config — the agent can drive PortSwigger Burp through the same MCP channel as any other server, which is powerful on engagements and risky on a shared dev machine.
SECURITY.md states the installer only copies local files and optionally appends a single source line to your shell profile — no network calls at install time from the installer itself. That reduces drive-by install malware; it does not limit what the agent does after skills load.
Authorization, safeguards, and model behavior
The bundle is framed for assets you own or have written authorization to test (bug-bounty scope, signed pentest RoE, CTFs, lab apps). Validation skills include triage-validation’s 7-Question Gate (scope and accepted-impact checks) and researcher hygiene in bugcrowd-reporting.
Two runtime limits sit outside the repo:
Anthropic cyber safeguards. The README warns that even authorized work can hit refusals from Anthropic’s real-time cyber safeguards, and points eligible testers to the Cyber Verification Program for adjusted safeguards on legitimate dual-use work — the same program family we discussed in Claude Mythos 5.2 and CVE rediscovery.
Model switching on Opus 5. The README notes that on Opus 5, some higher-risk cyber requests (exploit generation, binary-based vuln scanning, penetration testing) may fall back to Opus 4.8 with a notice — easy to miss in long agentic runs. /hunt is designed to state the engagement frame on turn one so session context is explicit.
None of that replaces your authorization paperwork. If you point an agent at a production URL without program scope, you inherit the legal and operational risk — the bundle’s gates are methodology prompts, not network enforcement.
Validation and reporting mechanics
When the README describes shipping a finding, it is not casual chat output. triage-validation runs a 7-Question Gate before submission — including whether the asset is in scope and whether impact matches the program’s accepted-impact list. evidence-hygiene covers cookie redaction, PII black-bars, and HAR sanitization so PoCs do not spray session material into reports. Platform-specific skills such as bugcrowd-reporting encode researcher hygiene (alias addresses, account restoration) that Bugcrowd’s fraud teams use as signals of legitimate testing.
The cbh CLI and /hunt scaffold (clone install) add engagement-folder structure and state so recon output, ranked hosts, and draft findings stay in one tree instead of scattering across chat logs — useful on multi-day bounties, and another reason to isolate the disk that holds those folders from personal email and payment profiles.
Supply-chain trust — what SECURITY.md admits
SECURITY.md is unusually candid for a skill repo:
- CI runs
scripts/lint_skills.pyon skill changes — structure and leaked secrets/engagement identifiers, not semantic safety. - It cites Snyk “ToxicSkills” (2026) and notes prompt injection in a meaningful fraction of public skills as industry context.
- It tells you to skim
SKILL.mdandskills/*/scripts/before install and pin a tag/commit rather than trackingmainblindly.
That aligns with Beam’s long-standing message on MCP tool poisoning and rug pulls: instructions in skills are untrusted input to the model. A well-intentioned offensive bundle can still contain stale payloads, over-broad shell snippets, or MCP instructions you do not want on a machine that also holds production keys — separate from malice.
Compare to malicious campaigns: strutil-core poisoned mcp.json and SessionStart hooks at gem install time. Claude-BugHunter is not that class of attack, but it does modify the same config surfaces when you choose copy install or --burp-mcp.
What this means if you run AI coding agents
If you bug bounty or pentest with Claude Code
- Use the plugin or a pinned clone — SECURITY.md recommends marketplace installs that pin to a commit SHA with Anthropic’s plugin screening, or
git checkout <tag>beforeinstall.sh. - Run engagements on isolated hosts — README skill content assumes external attack surface tooling (ProjectDiscovery stack, Burp, nuclei-style workflows in docs). Do not merge that environment with corp SSO sessions on your primary laptop.
- Wire Burp MCP deliberately — treat
--burp-mcplike adding any high-power MCP server: read the generated JSON, restrict which workspaces load it, and review MCP scanning limits. - Enroll in CVP if Anthropic refusals block legitimate work — the README’s supported path for authorized offensive testing, not prompt tricks to sound “defensive.”
- Log and review agent actions — offensive skills increase the chance the agent proposes scanners, curl chains, or OAuth probes. Unit 42’s ARTEX hallmarks apply to autonomous loops that look like red team but drift off RoE.
If you lead a team that does not hunt bugs
- Inventory
~/.claude/skills/and plugin marketplaces on shared machines — trending repos are how junior devs discover tooling. - Block or review installs that add dozens of skills at once the way you would block unreviewed VS Code extensions.
- Separate secrets — engagement tokens, HackerOne API keys, and Burp project files should not sit beside
~/.claude/.credentials.jsonon the same profile unless you accept blast radius.
Commands to verify what changed (after any teammate installs)
# Claude Code skill directories (copy install)
ls -la ~/.claude/skills/ 2>/dev/null | head
# MCP configs Burp may have touched
grep -ril burp ~/.claude ~/.cursor 2>/dev/null | head
# Codex / agents path when --all was used
ls -la ~/.agents/skills/ 2>/dev/null | head
Adjust paths for Windows (%USERPROFILE%\.claude\) per the README.
How Beam handles this
Beam is local-first observability and heuristic scanning for coding agents — see what agent monitoring tracks and how workspace policy works.
For a bundle like Claude-BugHunter, Beam can help in narrow, concrete ways:
- Pre-run skill and MCP scans — offline heuristic checks on
SKILL.md, hook files, and MCP JSON (including an MCP version-pin check) per skill and MCP scanning. A clean scan means no pattern matched, not “authorized for your target.” - PreToolUse deny on Claude Code and Codex — when workspace policy is in enforce, selected destructive or credential-touching command shapes can be blocked at the hook layer; coverage is hook-based, not kernel sandboxing.
- Event history on-device — review what the agent actually proposed after a long
/huntsession without sending telemetry to a vendor cloud by default.
Beam cannot tell whether your HackerOne scope covers api.target.com, judge Burp traffic legality, or stop you from installing the plugin. It does not replace reading 83 skills. Fail-open behavior applies when cached policy is missing — treat Beam as evidence and guardrails, not authorization.
Enterprise policy products such as WhiteMatter Guardian Agents aim at org-wide governance; Beam fits individual workstations and small teams who want on-device scan + watch without routing agent traffic through a SaaS control plane.
Related reading
- Cloudflare security-audit skill — defensive audit skill with sandbox requirements (contrast in intent).
- strutil-core RubyGem worm — malicious install-time poisoning of the same MCP surfaces.
- MCP security practical guide — what scanning catches and misses.
- Anthropic Mythos, Cisco, and IBM enterprise red teaming — how vendors package authorized offensive models separately from consumer Claude.
- Recorded Future’s AI incident taxonomy for coding tools — where agent misuse incidents cluster.
Details in this article reflect the Claude-BugHunter README, INSTALL.md, and SECURITY.md as published on the repository’s main branch as of November 15, 2026. Star counts change daily; verify on GitHub before citing them in compliance docs.
Frequently asked questions
What is Claude-BugHunter?
It is an open-source skill bundle by Sachin Sharma (elementalsouls) that packages 83 Agent Skills, 15 slash commands, and methodology for authorized bug bounty and external red-team work. The README describes hunt-* skills built from 681 curated HackerOne disclosure patterns across 24 vulnerability classes, plus enterprise identity and VPN attack matrices.
How do I install Claude Code skills from this GitHub repo?
Inside Claude Code, the README recommends /plugin marketplace add elementalsouls/Claude-BugHunter then /plugin install claude-bughunter@elementalsouls, which namespaces skills under claude-bughunter: without copying files into ~/.claude/. Alternatively, clone the repo and run bash scripts/install.sh (or install.ps1 on Windows) to copy skills into ~/.claude/skills/.
Does Claude Code use these skills automatically?
Yes, per the README. Skills load by topic when you describe what you are testing in plain English — you do not invoke each skill by name. That auto-loading is convenient for hunters and also means a large instruction surface is active whenever the bundle is installed.
Is Claude-BugHunter malicious?
The project is an explicit authorized-use bundle with MIT-licensed code and SECURITY.md that excludes malware, C2, and unauthorized targeting. That does not replace your own review: SECURITY.md cites independent research on prompt injection in public skills and says its CI lint is structural, not a malware or injection detector.
Can I use this bundle on Codex or other harnesses?
The README states the same SKILL.md files install to OpenCode, OpenAI Codex CLI (~/.agents/skills/), Hermes Agent, and Google AntiGravity via install.sh --all. Slash commands and the /hunt engine remain Claude-Code-only.
Why did Claude refuse or switch models during a hunt session?
Anthropic applies real-time cyber safeguards that can block offensive work by default. The README points authorized testers to the Cyber Verification Program (CVP) and notes that on Opus 5 some higher-risk cyber requests fall back to Opus 4.8 rather than being refused — easy to miss in long agent runs.
What should I check before installing any third-party skill bundle?
Read SKILL.md and bundled scripts, pin a reviewed commit or plugin version, verify Burp MCP wiring if you use --burp-mcp, and separate authorized engagement machines from everyday dev laptops. Compare with how you would vet any repo that edits ~/.claude/ or mcp.json.
Does Beam block Claude-BugHunter?
No. Beam runs offline heuristic scans on skills and MCP JSON and can deny selected PreToolUse actions on Claude Code and Codex when policy is in enforce mode. It does not judge whether a skill is legally authorized for your target or replace reading the bundle yourself.