---
name: al-327-hunt-for-security-bugs-like-a-team-give-claude-code-a-pla
description: "Asking an AI to \"find bugs\" gets noise. A free open-source kit, Claude-BugHunter, packs 83 security skills and 700+ patterns from real disclosed bug reports into Claude Code, and walks a set path: confirm scope, map the attack surface, hunt by vulnerability type, reproduce and kill false positives, then write a report triage teams actually read. Payouts aren't guaranteed, and testing anything outside an authorized program's scope is illegal. Use when the user wants help with bug bounty & testing (security) for a small business."
---

# Hunt for security bugs like a team: give Claude Code a playbook built from 700+ real disclosed reports, and only test targets you're authorized to test

Asking an AI to "find bugs" gets noise. A free open-source kit, Claude-BugHunter, packs 83 security skills and 700+ patterns from real disclosed bug reports into Claude Code, and walks a set path: confirm scope, map the attack surface, hunt by vulnerability type, reproduce and kill false positives, then write a report triage teams actually read. Payouts aren't guaranteed, and testing anything outside an authorized program's scope is illegal.

## Inputs to collect first
Ask the user for anything below that they haven't already given you. Don't guess missing facts.

- Bug bounty program or my own app
- In-scope targets, out-of-scope items and testing rules

## Instructions

Do the task below with the user's inputs in place of each [bracket].

I'm doing authorized security testing. The program is [bug bounty program or my own app], and its scope rules are: [paste in-scope targets, out-of-scope items and testing rules]. Work in this order and stop to ask me before any step that could change data or send many requests. 1) Restate the scope and list anything you will NOT touch. 2) Map the attack surface from what I give you (URLs, API docs, JavaScript files, features): list features worth testing and why. 3) For each, name the likely vulnerability types (for example access-control mistakes, injection, SSRF, auth bypass) and a safe, low-impact test. 4) When I paste a result, decide: real issue, false positive or needs more proof, and say what evidence is missing. 5) For confirmed issues, write a report: title, severity with reasoning, affected endpoint, steps to reproduce, impact, evidence and a suggested fix. Never test outside scope, never access other users' real data beyond what's needed to prove the issue, and never run denial-of-service tests.

## Safety checks (share these with the user)

- Read and edit the draft before it reaches a customer or goes public. If you later automate this prompt, start with "draft and notify me", not "send automatically".
- Check names, dates, numbers and any claim against your own source material before you use the answer. AI can misread or invent details.
- Say clearly which parts need a person to review or approve before anything is sent, paid, posted or filed.

## About this skill

- Works with: Claude Code, Claude-BugHunter, Burp Suite
- Based on this real-world example: https://github.com/elementalsouls/Claude-BugHunter
- Free prompt from AgentPlaybook Real Estate: https://agentic-library.netlify.app/prompt/al-327-hunt-for-security-bugs-like-a-team-give-claude-code-a-playbo/
- To install in an agent that supports Agent Skills, save this file as SKILL.md in a folder with the same name as `name` above (for example in your skills directory). Install steps for Claude.ai, Claude Code, Cursor and Codex: https://agentic-library.netlify.app/skills/