bb-hunter, a bug bounty hunting skill for Claude Code. It orchestrates an end to end workflow for web2 programs on HackerOne, Bugcrowd, Intigriti, and YesWeHack, and web3 programs on Immunefi.
Current version: 4 (see VERSION and the Changelog in SKILL.md).
Why Chrome MCP?
When I started hunting programs, both with and without AI, I found that the AI did not really understand the concept of the web, especially what the web actually looks like. So I added Chrome MCP to give the AI the same vision a human has (I hope so!).
This is just an idea I have been thinking about, and it still needs a lot of improvement, both the Chrome MCP side and the skill itself. I keep hunting many programs to see how it works in practice.
Right now it does not work like a magic button that you fire once and get ten criticals back. It is more like a person. You have to give it time to understand the whole product, and for a human that can take one or two months to understand deeply.
A browser-first pipeline. The target is explored as a real user through a real browser (Chrome DevTools MCP) proxied through an intercepting proxy (Burp MCP) before curl is used; curl is demoted to quick checks and PoC text. Recon and hunting fan out across spawned agent workflows for speed and coverage.
Seven steps across phases 1, 1.5, and 2 to 6:
- Scope reading with a viability gate (WAF/Bot Manager, auth path, saturation, and OSS component ownership).
- Application understanding, a browser walkthrough that produces an app-specific attack surface map.
- Recon, fanned out across agents.
- Blackbox logic hunting driven by the attack surface map.
- PoC construction, functional and reproducible.
- Report writing in the program's expected format.
- Fresh verification, including dedup against public prior art and the researcher's own prior campaign, and a real versus payable check.
SKILL.md— the orchestration logic and phase-by-phase procedure.references/— 14 supporting docs (scope reading, PoC rules, report format, style guide, verification checklist, auth acquisition, recon toolkit, WAF detection, workflow orchestration, logic bug patterns, and more).VERSION— the skill version.
- Engagement data. Findings, reports, PoCs, and recon output live in a local
bb-output/directory that is gitignored and never published. It can contain unsubmitted work. - Credentials. Researcher platform tokens live only at
~/.bb-hunter/credentials, never in the repo, reports, or any artifact.
Installed as a Claude Code skill. Invoke with /bb hunt, /bb scope, /bb recon, /bb report, or a natural phrase like bug bounty <program>.