How to use the SRC Hunter bug bounty agent skill (src-hunter)

What the src-hunter skill makes the agent do

The skill turns an agent into a structured bug bounty assistant. It follows five phases: intake (reading the program scope and rules), passive recon (collecting information without sending traffic to the target), active enumeration (finding assets and content), vulnerability hunting, and report writing.

The source describes 19 attack-class playbooks (for example SQL injection, XSS, SSRF, IDOR, file upload, GraphQL and LLM prompt injection), about 305 structured payloads, around 263 WAF/EDR bypass variants, and reference files for Chinese software fingerprints and default credentials. It also includes industry notes for banking and telecom targets.

• Intake: pull in-scope and out-of-scope assets, payout and disclosure rules, and any test header the program requires.
• Recon: certificate transparency logs, web archives, GitHub search, search engine dorks and similar sources.
• Enumeration: subdomains, live hosts, content discovery and technology fingerprinting with command-line tools.
• Hunting: each attack class has its own playbook, and the skill recommends starting with high-value, high-hit-rate classes.
• Reporting: a submission template with a precise title, reproduction steps and an impact section.

Install the src-hunter skill

Download the skill ZIP from our page and unzip it into one of two places. For a personal install, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project. Claude Code loads skills from these folders.

If you use the Claude apps instead of Claude Code, upload the skill under Settings → Capabilities → Skills.

The upstream project README also lists a plain git option that clones the repository straight into your skills folder. Use it if you prefer to keep the skill up to date with git.

• Personal install: ~/.claude/skills/ (the skill folder should contain SKILL.md at its top level).
• Project install: .claude/skills/ inside the project folder.
• Claude apps: Settings → Capabilities → Skills, then upload the skill.

Set up authorization and a case folder first

The SKILL.md file starts with an ACTION REQUIRED section that the agent should follow before any testing. The first step is to confirm that the current case has a scope.md file and an auth.status=granted record. If there is no scope, the file says to create one with case-init.ps1, and it explicitly forbids setting the granted flag automatically.

Treat this as a hard gate. Write the scope yourself from the program's written rules, and only proceed when the target and the test are inside that scope.

• Create or confirm scope.md for the program you are testing.
• Record auth.status=granted only when you have written authorization for the in-scope targets.
• Do not let the agent set the granted status on your behalf.

Trigger the skill with natural requests

The skill loads when your request contains keywords it lists, such as 'src 挖洞', 'src 漏洞挖掘', 'bug bounty', '众测', 'hackerone', '漏洞赏金', 'SRC', '渗透测试', 'WAF bypass' and similar terms. It also triggers when you ask how to test a specific target, API or parameter, or how to bypass a WAF.

Give the agent a concrete target and a concrete goal, and name the program when you can. Requests that name a phase, such as recon or report writing, also work well. The argument hint in the skill is <target-or-program-or-phase>.

• Use the program name, the in-scope domain or the API endpoint in your request.
• Name the phase you want, for example 'run intake on this program' or 'write the report for this finding'.
• The skill is not meant for pure source code audits, which the SKILL.md says belong to a different skill, or for general defensive security questions.

An example session from intake to report

A typical session starts with you giving the agent a program name and its scope page. The agent reads the rules, checks the case folder, and then moves through recon and enumeration using the tools you have installed. When it reaches hunting, it opens the playbook that matches the entry point it found, such as an exposed admin interface, an ID parameter that can be changed or a file upload form.

The source says the default is to read only the playbook skeleton. Payload and WAF bypass files are opened only when the scope is granted and you explicitly ask for payloads. Findings should be backed by real HTTP requests, screenshots or video, and the report template is used for the final write-up.

• Ask for intake first and review the scope summary the agent produces.
• Ask for passive recon before any active enumeration.
• Ask for a specific playbook once you have a candidate endpoint.
• Ask for the report template only after you have reproduced the issue yourself.

Requirements, safety notes and limits

The skill itself does not run scripts, but it uses the network, since its workflow drives external reconnaissance and testing tools. You install those tools separately. The source names examples such as subfinder, httpx, ffuf, amass, Burp Suite, sqlmap and Metasploit. An optional MCP server, jshookmcp, can serve as the tool layer.

The skill is meant only for programs with documented scope and authorization. The source lists general red lines: stay out of scope, do not keep copies of other people's personal data, keep load to a few proof-of-concept requests, do not modify others' data, and do not run phishing or social engineering against production. Use test headers that identify you, such as X-Bug-Bounty with your handle, and use your own accounts for authorization tests.

• Required: command-line recon and scanning tools, installed separately, and a case folder with scope.md and auth.status=granted.
• Optional: the jshookmcp MCP server for the tool layer.
• Do not use the skill against systems without written authorization or outside program scope.
• For brute force against default credentials, the reference file suggests a rate cap of 4 concurrent requests and 50 attempts per hour per target.
• If an antivirus flags the payload corpus, the source says to verify file hashes rather than disable protection.