Claude-BugHunter: is it really 82 bug-hunting skills?
The claim“A curated bundle of 82 skills for Claude Code for vulnerability auditing, CVE tracking and structured red-team work”
Live stats · checked
Review lives at rockytested.com · @RockyTested
With vs without
With vs withoutNo with-skill pass count is on file.
No baselinebaseline The normal way of doing the same job, used as the yardstick. Rocky compares every claim against a baseline on the same machine. Glossary pass count is on file.
Usefulness is a separate question from “does the repo exist.” It needs the same task run twice. Until that A/B is published, both cells stay blank.
What the test plan says
Count every SKILL.md, validate each has frontmatter, and list the slash-commands the bundle registers. Static read only, no red-team run.
Four verdicts
One stamp is not the whole story. Works, Safe, Claims honest, and Provenance are four separate written calls. A missing call stays “not tested yet.”
No written call is on file. This is not a pass.
No written call is on file. This is not a pass.
No written call is on file. This is not a pass.
No written call is on file. This is not a pass.
Safety is a hard cap. If Safe is no, the Rocky Score cannot rise above 44 (grade F), even when the tool works. A blank Safe card means not tested yet, not safe. How the four verdicts roll up →
| Claim part | Measured | Result |
|---|---|---|
| Finding 1 | There are 83 skill files against the 82 claimed, all with valid frontmatter, plus 15 slash-commands | holds |
What it is: A Claude Code bundle that claims 82 skills for finding vulnerabilities. Rocky counts the skills and commands rather than taking the number on faith; the actual bug-finding ability is a separate, later test. Claim source →
There are 83 skill files against the 82 claimed, all with valid frontmatter, plus 15 slash-commands.
⚠️ Read this before quoting the verdict
- The claim is about the size of the bundle. Whether these skills find real bugs wasn't measured.
Claim ledger
Claim ledgerEvery distinct claim in the pitch gets a row: what was said, what the command said back. 1 claim on the ledger: 1 not measured. No separate ledger file yet, so these rows are the review's claim list only. “Not tested” means that claim has no measurement.
- ? Not tested
“A curated bundle of 82 skills for Claude Code for vulnerability auditing, CVE tracking and structured red-team work” source
🔍 Coverage: Not stated yet. Rocky only lists the parts a run actually checked.
⚗️ Unproven usefulness. Counting and parsing can settle what the repo claims. It can't settle whether the thing actually helps — that takes an A/B run (same task with and without it), which hasn't happened yet.
Rocky's take: good uses & where it will fail you
Good uses
Good uses- Organizing a red-team workflowA security hobbyist wants structured steps—recon, triage, report—for a CTF; the bundle's 15 slash-commands like hunt and recon give a ready-made checklist to follow.
- Tracking CVEs across a big auditA junior pentester auditing a client app wants a consistent set of categories to work through; the 83 skill files, all with valid frontmatter, give organized starting points.
- Web3 contract auditsSomeone auditing a smart contract can use the web3-audit command as a starting checklist instead of building one from scratch.
- Chaining multi-step exploit workflowsA student learning red-team process wants one skill to flow into the next; the chain command is built for linking steps together.
Where it will fail you
Where it will fail you- Expecting it to actually find bugsA beginner hoping the 82 (really 83) skills will automatically catch vulnerabilities will be disappointed—this test only checked that the skills exist, not that they catch real bugs.
- Overwhelmed by sheer number of skillsSomeone new to security opens 83 separate skill files and 15 commands and doesn't know where to start, since nothing here ranks or prioritizes them.
- Treating command names as full toolsA user runs 'recon' or 'triage' expecting a complete automated scanner, but these are skill definitions for Claude Code, not standalone scanning engines.
- Verifying claims beyond the countAnyone wanting proof the skills reduce real-world bug-hunting time won't find it here—the measurement only counted files and frontmatter, not actual results.
🤖 Drafted by an AI model from Rocky's measured results only; every number was machine-checked against the test data. People in the examples are made up.
Where this repo comes from
Where this repo comes from
Provenance is age, authors, commitcommit One saved version of a repo's code. Rocky pins the exact commit so anyone can rerun the same code. Glossary · Learn more bursts, and where the README sends you. It is published only from commands Rocky ran. Nothing is guessed, so this section stays blank until that file exists.
Results, charted
Results, chartedRocky draws these at build time from the run's own numbers. Hover or read the hidden table for exact values. Verdict colors: green holds, yellow stretched, red failed, teal measuring.
| Group | Series | Value |
|---|---|---|
| Contents | Claimed skills | 82 |
| Contents | Found skills | 83 |
| Contents | Valid frontmatter | 83 |
| Contents | Slash-commands | 15 |
Score
ScoreGraded on 50 of 100 weight points. Parts marked “not measured” are left out of the math, not counted as zero.
Medium confidence: claim test with one run per setup. How scores work. Scores only use measured results; parts Rocky didn't measure show as “not measured” and don't count.
Retest history
Testing ends when the run ends. If the repo ships a new version with a bold new claim, or newer models make a fair rematch possible, Rocky reruns the same test packet and the new result lands here next to the old one, so you can compare versions and models side by side.
Rerun it yourself
Rerun it yourself📦 When the test is done, the exact scripts, raw results and a copy-paste prompt for your own AI agentAI agent An AI that takes actions in steps (runs commands, edits files, browses) instead of only chatting. Glossary · Learn more will appear here.
Repo & thanks
- Claude-BugHunter: A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices. Built by @elementalsouls. Thank you!
Where the claim was posted
Claude-BugHunter provides a curated bundle of 83 skills for Claude Code designed to assist with vulnerability auditing, CVE tracking, and structured red team reporting. https://github.com/elementalsouls/Claude-BugHunter
Counts as of (Rocky's last check)
Where else this repo is talked about
On X: 15 posts linking the repo
Posts from to , in 6 languages. Checked . Found with X search for links to the repo; more may exist. Oldest first:
- Earliest we found @taybsediqi @Zerova_ca❤️ 21 · 🔁 3 · 📊 1.8K open
- @EsGeeks 🛡️🔍🤖 Claude-BugHunter | Skill bundle para bug hunting y red team externo 83 skills + 15 comandos. Patrones de 681 reportes + cadenas enterprise. #bugbounty #redteam #appsec #ciberseguridad #claude #ethicalhacking❤️ 108 · 🔁 14 · 📊 3.3K open
- @x5cnhp Claude Code 真就只是个普通聊天机器人？这么看可就把它想简单了，会折腾的人早拿它去干赏金猎人的活了。 83 项技能、681 份漏洞报告模板、24 类攻击手法，装上就成老练漏洞猎手——连跟平台扯皮的话术都帮你备齐了。 你这边还在犹豫，人家那边已经开始数钱了❤️ 0 · 🔁 0 · 📊 181 open
- @x5cnhp Claude Code 要是只当聊天机器人用，那可真把它看扁了，会玩的人早让它干起赏金猎人的活。 83 项技能、681 份漏洞报告模板、24 类攻击手法，装上就变老练漏洞猎手——连跟平台扯皮的话术都给你备好了。 你还在纠结，别人已经开始数钱了❤️ 4 · 🔁 0 · 📊 728 open
- @kfhshl 还以为 Claude Code 只是个普通聊天机器人？那可真是大材小用了。会玩的人早让它干起赏金猎人的活了。 83 项技能、681 份漏洞报告模板、24 类攻击手法，装完直接变身老练的漏洞猎手——连怎么跟平台扯皮都帮你写好了。 你还在犹豫，别人已经在数钱了❤️ 21 · 🔁 2 · 📊 1.3K open
- @tom_doerr Claude-BugHunter provides a curated bundle of 83 skills for Claude Code designed to assist with vulnerability auditing, CVE tracking, and structured red team reporting.❤️ 591 · 🔁 92 · 📊 32K open
All 15 posts, oldest first
- Earliest we found @taybsediqi @Zerova_ca❤️ 21 · 🔁 3 · 📊 1.8K open
- @EsGeeks 🛡️🔍🤖 Claude-BugHunter | Skill bundle para bug hunting y red team externo 83 skills + 15 comandos. Patrones de 681 reportes + cadenas enterprise. #bugbounty #redteam #appsec #ciberseguridad #claude #ethicalhacking❤️ 108 · 🔁 14 · 📊 3.3K open
- @x5cnhp Claude Code 真就只是个普通聊天机器人？这么看可就把它想简单了，会折腾的人早拿它去干赏金猎人的活了。 83 项技能、681 份漏洞报告模板、24 类攻击手法，装上就成老练漏洞猎手——连跟平台扯皮的话术都帮你备齐了。 你这边还在犹豫，人家那边已经开始数钱了❤️ 0 · 🔁 0 · 📊 181 open
- @x5cnhp Claude Code 要是只当聊天机器人用，那可真把它看扁了，会玩的人早让它干起赏金猎人的活。 83 项技能、681 份漏洞报告模板、24 类攻击手法，装上就变老练漏洞猎手——连跟平台扯皮的话术都给你备好了。 你还在纠结，别人已经开始数钱了❤️ 4 · 🔁 0 · 📊 728 open
- @kfhshl 还以为 Claude Code 只是个普通聊天机器人？那可真是大材小用了。会玩的人早让它干起赏金猎人的活了。 83 项技能、681 份漏洞报告模板、24 类攻击手法，装完直接变身老练的漏洞猎手——连怎么跟平台扯皮都帮你写好了。 你还在犹豫，别人已经在数钱了❤️ 21 · 🔁 2 · 📊 1.3K open
- @tom_doerr Claude-BugHunter provides a curated bundle of 83 skills for Claude Code designed to assist with vulnerability auditing, CVE tracking, and structured red team reporting.❤️ 591 · 🔁 92 · 📊 32K open
- @NeoteoCom Claude-BugHunter trae 83 skills para Claude Code: auditoría de vulnerabilidades, seguimiento de CVEs y reportes de red team estructurados.❤️ 1 · 🔁 0 · 📊 226 open
- @t1gerxt1ger Claude Code 向けの脆弱性調査スキル集が公開。 ・83 スキル・15 コマンドを同梱 ・HackerOne の報告 681 件を元に構成❤️ 1 · 🔁 0 · 📊 55 open
- @ngnicky Claude Code의 버그 헌팅 및 외부 레드팀 작업을 위한 스킬 번들 - 82가지 스킬, 15가지 슬래시 명령어, 24가지 핵심 취약점 유형에 걸쳐 엄선된 681가지 공개 보고 패턴, 그리고 기업 ID 및 인프라 공격 매트릭스가 포함되어 있습니다.❤️ 218 · 🔁 43 · 📊 11K open
- @hemran_7282 Claude-BugHunter provides a curated bundle of 83 skills for Claude Code designed to assist with vulnerability auditing, CVE tracking, and structured red team reporting. #CyberSecurity #InfoSec #e0xsecops #TechLeadershi❤️ 0 · 🔁 0 · 📊 42 open
- @Manorgw 难道 Claude Code 在你手里，就只是个普通对话工具？会玩的人早让它去干赏金猎人的活了。 82 个技能、681 份漏洞报告模板、24 类攻击手法，装完就是一个老练的漏洞猎手，连怎么跟平台沟通都给你写好了。 你还在犹豫，别人已经在收钱了。 🔗❤️ 6 · 🔁 0 · 📊 806 open
- @4devvvv SOMEONE TURNED CLAUDE INTO A FUCKING PROFESSIONAL HACKER ??? Meet claude-bughunter, an open-source skill bundle designed to transform Claude Code into an AI-powered security researcher. And this isn't some basic chatbot prompt. 83 SECURITY SKILLS. 15❤️ 1 · 🔁 0 · 📊 266 open
- @UnTalNixon_exe Repo:❤️ 1 · 🔁 0 · 📊 140 open
- @Survis_com GitHub:❤️ 0 · 🔁 0 · 📊 0 open
- @ai4cybersec Repo:❤️ 0 · 🔁 0 · 📊 2 open
Ran it yourself?
Share your rerun
- Download the rerun bundle above.
- Run it, or paste the prompt into your AI agent.
- Post your
results.json(a gist is fine) and reply to @RockyTested with the link.
Rocky reruns or spot-checks every submission before it counts. Verified reruns will appear here with your handle.
🏅 Helper leaderboard
No verified reruns yet. Be the first!
Street cred goes to people whose reruns Rocky verified: same bundle, raw output included, numbers re-checked. How it works
Badge & stat card
Put the verdict badge in a README or post. It always links back to the measured results.
[](https://rockytested.com/reviews/elementalsouls-claude-bughunter/)
Stat card (1200×630). This is what shows up when the review is shared on X.
Machine-readable: /v1/reviews/elementalsouls-claude-bughunter · Words with a dotted underline have a quick explanation: hover or tap. Glossary