BugSkill AI: HackerOne Bug Bounty Intelligence & Awesome AI Agent Skills

An enterprise-grade repository combining 9,950+ real-world disclosed HackerOne bug bounty reports ($3.26M+ in bounties paid) with two curated, modular, dynamic collections of Universal AI Agent Skills (Awesome-Claude-Code-Agent-Skills/ & Personal-Claude-Code-Agent-Skills/) built for next-generation AI coding assistants: Claude Code, Gemini CLI, Google Antigravity, ChatGPT / Codex CLI, and Cursor.

📑 Table of Contents

• 📊 Dataset Overview
• 📦 Curated Agent Skills Collections
  • 1. Awesome Claude Code Skills (Awesome-Claude-Code-Agent-Skills/)
  • 2. Personal Bug Bounty Intelligence Skills (Personal-Claude-Code-Agent-Skills/)
• 📁 Clean Repository Layout
• ⚡ Zero External Dependencies
• 🤖 Universal Agent Skills Framework ("Using It")
  • 1. Cross-Agent Compatibility Matrix
  • 2. One-Command Universal Sync
  • 3. Using with Claude Code
  • 4. Using with Gemini CLI & Google Antigravity
  • 5. Using with ChatGPT / Codex CLI
  • 6. Using with Cursor / VS Code
• 🔎 Offline Report Search & Intelligence CLI (search_reports.py)
• ⚡ HackerOne Hacktivity Downloader (hackerone_public.py)
• 📜 License & Responsible Disclosure

📊 Dataset Overview

The repository includes an offline intelligence dataset of 9,950 disclosed vulnerability reports fetched directly from the official HackerOne Hacktivity REST API.

📦 Curated Agent Skills Collections

1. Awesome Claude Code Skills (Awesome-Claude-Code-Agent-Skills/)

A curated collection of 13 open-source offensive security, reconnaissance, and bug bounty skills:

2. Personal Bug Bounty Intelligence Skills (Personal-Claude-Code-Agent-Skills/)

Custom, deep vulnerability analysis skills derived directly from real-world HackerOne disclosed reports:

📁 Clean Repository Layout

.
├── README.md                              # Repository documentation & universal agent guide
├── Assets/                                # Media assets & project branding
│   └── BugSkill-AI-Logo.png               # Official BugSkill AI Logo
├── requirements.txt                       # Dependency notes (Zero external dependencies)
├── search_reports.py                      # Offline multi-filter search CLI (Python stdlib)
├── hackerone_public.py                    # HackerOne API Hacktivity downloader (Python stdlib)
├── hackerone_public_reports.json          # Offline dataset (9,950 disclosed reports)
│
├── Awesome-Claude-Code-Agent-Skills/      # 🌟 Open-Source Curated Security Skills (13 Skills)
│   ├── 403Bypass/                         # 403 Forbidden bypass automation
│   ├── ApexDiscovery/                     # Root & apex domain discovery
│   ├── AsnRecon/                          # BGP ASN & IPv4 range reconnaissance
│   ├── bac-analyzer/                      # Passive traffic BAC & IDOR analysis
│   ├── BugBountyWorkflow/                 # Bug hunting workflow & reporting
│   ├── CacheDeception/                    # Web cache deception exploitation
│   ├── crawl/                             # Deep web crawling (hakrawler + gospider)
│   ├── jsa/                               # DevTools JavaScript security analysis
│   ├── JsAnalyzer/                        # Static JS vulnerability auditing
│   ├── osint-enrich/                      # OSINT target intelligence dossiers
│   ├── pulse-template/                    # Daily threat & technology digest
│   ├── SubdomainEnum/                     # Subdomain enumeration & prioritization
│   └── TabletopExercise/                  # Incident response tabletop scenarios
│
└── Personal-Claude-Code-Agent-Skills/     # 🛡️ HackerOne Intelligence Skills (Custom)
    ├── Note.md                            # Master ledger of converted HackerOne report IDs
    ├── otp-bruteforce-testing/            # OTP Brute-Force & Oracle Testing Skill
    ├── stack-bounds-format-auditing/      # Stack Buffer Overflow & Bounds Auditing
    └── url-parser-confusion-testing/      # URL Parser Inconsistencies & SSRF Bypass

⚡ Zero External Dependencies

All core utilities, dataset search tools, and primary skill scripts are written natively using the Python 3 Standard Library (Python 3.8+):

• search_reports.py (json, argparse, pathlib, collections)
• hackerone_public.py (urllib.request, base64, json, argparse)
• Personal-Claude-Code-Agent-Skills/* (urllib.request, threading, json, argparse, ipaddress, subprocess)

No third-party packages or pip install steps are required for core operations.

🤖 Universal Agent Skills Framework ("Using It")

Every skill in this repository contains structured instructions and workflows making it compatible across all major agent environments.

1. Cross-Agent Compatibility Matrix

2. One-Command Universal Sync

Install all skills into your local agent environment with a single command:

Linux / macOS (Bash / Zsh):

# Sync ALL skills to Claude Code (Project Scope)
mkdir -p .claude/skills
cp -r "Awesome-Claude-Code-Agent-Skills/"* .claude/skills/
cp -r "Personal-Claude-Code-Agent-Skills/"* .claude/skills/

# Sync ALL skills to Claude Code (Global Scope)
mkdir -p ~/.claude/skills
cp -r "Awesome-Claude-Code-Agent-Skills/"* ~/.claude/skills/
cp -r "Personal-Claude-Code-Agent-Skills/"* ~/.claude/skills/

# Sync ALL skills to Gemini CLI, Google Antigravity & Codex
mkdir -p ~/.agents/skills
cp -r "Awesome-Claude-Code-Agent-Skills/"* ~/.agents/skills/
cp -r "Personal-Claude-Code-Agent-Skills/"* ~/.agents/skills/

Windows (PowerShell):

# Sync ALL skills to Claude Code (Project Scope)
New-Item -ItemType Directory -Force -Path ".claude\skills"
Copy-Item -Recurse -Force "Awesome-Claude-Code-Agent-Skills\*" ".claude\skills\"
Copy-Item -Recurse -Force "Personal-Claude-Code-Agent-Skills\*" ".claude\skills\"

# Sync ALL skills to Gemini CLI, Google Antigravity & Codex
New-Item -ItemType Directory -Force -Path "$HOME\.agents\skills"
Copy-Item -Recurse -Force "Awesome-Claude-Code-Agent-Skills\*" "$HOME\.agents\skills\"
Copy-Item -Recurse -Force "Personal-Claude-Code-Agent-Skills\*" "$HOME\.agents\skills\"

3. Using with Claude Code

Direct Slash Commands

/403Bypass
/SubdomainEnum
/ApexDiscovery
/JsAnalyzer
/TabletopExercise
/otp-bruteforce-testing
/url-parser-confusion-testing
/stack-bounds-format-auditing

Natural Prompting (Auto-Invocation)

Claude Code automatically indexes skill descriptions and activates them dynamically when you describe relevant security tasks:

"Perform subdomain enumeration and prioritize live targets for example.com."
"Audit our authentication API for OTP brute-force bypasses."

4. Using with Gemini CLI & Google Antigravity

• Auto-Discovery: Antigravity and Gemini CLI automatically load and execute any skill located in .agents/skills/ or ~/.agents/skills/.
• Natural Execution: Prompt the agent with the target domain or source code to audit.

5. Using with ChatGPT / Codex CLI

• Codex CLI reads skills from .agents/skills/ or ~/.codex/skills/.
• List active skills with codex /skills.

6. Using with Cursor / VS Code

• Add skill references in .cursorrules or @mention any SKILL.md file directly in the chat panel.

🔎 Offline Report Search & Intelligence CLI (search_reports.py)

Search and analyze the 9,950+ disclosed reports dataset offline with sub-second execution:

# 1. Global keyword search
python search_reports.py "OTP"
python search_reports.py "IDOR"
python search_reports.py "SSRF"

# 2. Filter by severity and minimum bounty
python search_reports.py "bypass" --severity critical --min-bounty 2500

# 3. Filter by CWE category
python search_reports.py --cwe "CWE-307"
python search_reports.py --cwe "CWE-79" --limit 10

# 4. Filter by target company/program
python search_reports.py --program "shopify" --severity high

# 5. Inspect deep report details by ID
python search_reports.py --id 3265780
python search_reports.py --id 2551512

# 6. Display high-level dataset statistics
python search_reports.py --stats

# 7. Output structured JSON for scripts and CI/CD pipelines
python search_reports.py "RCE" --severity critical --json

⚡ HackerOne Hacktivity Downloader (hackerone_public.py)

To refresh or append newly disclosed reports directly from the HackerOne REST API:

1. Obtain your API Identifier and Token from HackerOne Settings -> API.
2. Set your environment variables:

# Linux / macOS
export H1_API_IDENTIFIER="YOUR_IDENTIFIER"
export H1_API_TOKEN="YOUR_TOKEN"

# Windows (PowerShell)
$env:H1_API_IDENTIFIER="YOUR_IDENTIFIER"
$env:H1_API_TOKEN="YOUR_TOKEN"

1. Run the downloader:

# Download latest 10 pages (500 reports)
python hackerone_public.py --max-pages 10

# Download all disclosed reports (0 = unlimited)
python hackerone_public.py --max-pages 0 --output hackerone_public_reports.json

📜 License & Responsible Disclosure

• License: Distributed under the MIT License.
• Responsible Disclosure & Ethics: All disclosed vulnerability reports in this dataset are public data published by HackerOne under mutual agreement with respective security teams. This toolkit is intended solely for authorized security assessments, defensive hardening, and educational research. Always obtain explicit authorization before testing any third-party infrastructure.