Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Updated documentation in CHANGELOG.md, README.md, and SKILL.md to reflect recent workflow and methodology improvements. - Added or expanded vulnerability-specific reference material for chaining, SSRF, RCE, and XXE. - Bumped version to 0.0.5. - No functional/logic changes to agent workflow or capabilities.
What This Skill Does
Bug bounty hunting agent for web apps and APIs, covering recon, vulnerability auditing, exploit validation, and platform-specific report writing. Supports 18 vulnerability classes including XSS, SQLi, SSRF, IDOR, and RCE. Works against live targets (black-box) and locally downloaded source code (white-box).
It enforces a validation gate before any finding is reported, filtering out false positives that typically get closed by triage without reward.
When to use it
- Auditing a web app enrolled in an active HackerOne program
- Finding IDOR bugs by swapping resource IDs across two test accounts
- Reviewing a downloaded GitHub repo for injection vulnerabilities
- Writing a Bugcrowd-formatted report for a confirmed SSRF finding
- Chaining a low-severity CORS misconfiguration into a higher-impact exploit
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: 'Find vulnerabilities in this HackerOne target at app.example.com'
- 1Asks user to confirm the target is within active program scope
- 2Maps attack surface: subdomains, tech stack, auth mechanism, and API type
- 3Runs quick-win checks including IDOR with two accounts, password reset token reuse, and mass assignment via role fields
- 4Traces attacker-controlled input to dangerous sinks for each candidate finding
- 5Generates a HackerOne-formatted markdown report for confirmed medium+ severity bugs
Structured bug report with title, severity, confidence level, attack path, PoC request, and recommended fix