skillpicker.
Back to all topics
English
← Browse all topicsTasks

Bug Bounty Agent Skills for Recon

Bug bounty skills cover the full disclosure process: scoping what you are allowed to touch, reconnaissance to map what actually exists, finding and proving an issue with a working demonstration, writing a report a defender can reproduce and fix, handling disclosure, and the program-side work of triage and bounty decisions. These are task skills, not a single tool — some help you stay inside program rules, others help you turn a finding into something a defender can act on. Use the ranked list by reading the sub-topic labels first and picking the stage you are actually stuck at, rather than the one that sounds most exciting. Then check what each skill expects as input and produces as output, so it fits the workflow you already have.

1 to start with13 top options

Start with these.

A bounty is a disclosure process: recon, find, prove, report, then wait through triage — with rules that protect both sides.

These are the closest matches for this work. Start with the first one and open it to install.

What you are allowed to touch, and what gets you in trouble. A sub-problem of this domain with no skills yet.Map what actually exists before poking it.A working demonstration, not a theory.Enough for a defender to reproduce and fix.When (and whether) the rest of the world hears. A sub-problem of this domain with no skills yet.The program's side: is this real, in scope, and worth paying? A sub-problem of this domain with no skills yet.

13 top options

  1. Rank 01
    Direct

    penetration-testing-with-strix

    Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth/access-control flaws, IDOR, business logic) instead of just flagging them. Runs self-hosted…

    by usestrix/strix

    • Find & prove
    12,429 · popularity
    View Agent Skill
Explore 12 more Agent Skills
  1. Rank 09
    Possible

    differential-review

    Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for…

    by trailofbits/skills

    • Find & prove
    • Report
    7,486 · popularity
    View Agent Skill
  2. Rank 10
    Possible

    fp-check

    Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked whether a specific finding is real, exploitable, or a false positive, or to verify or validate a suspected…

    by trailofbits/skills

    • Find & prove
    • Report
    6,501 · popularity
    View Agent Skill
  3. Rank 11
    Possible

    find-bugs

    Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

    by getsentry/skills

    • Recon
    • Report
    6,562 · popularity
    View Agent Skill
  4. Rank 12
    Possible

    security-review

    Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with…

    by getsentry/skills

    • Find & prove
    • Report
    19,221 · popularity
    View Agent Skill
  5. Rank 13
    Possible

    security-best-practices

    Official

    Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

    by openai/skills

    • Find & prove
    • Report
    View Agent Skill
  6. Rank 14
    Possible

    golang-security

    Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing.…

    by samber/cc-skills-golang

    • Recon
    • Find & prove
    • Report
    38,753 · popularity
    View Agent Skill
  7. Rank 15
    Possible

    audit-website

    Notable

    Audit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-optimized report, then drives an iterative fix loop, mapping issues to source files, applying fixes, and re-auditing until the site scores well. Use to discover and assess website or webapp issues and drive them to fixed.

    by squirrelscan/skills

    • Report

    Needs (stated): CLI tool

    71,267 · popularity
    View Agent Skill
  8. Rank 16
    Possible

    browser-fingerprint-audit

    Audit a browser fingerprint for internal contradictions with the liarjs CLI - canvas, WebGL, WebGL2, WebGPU, audio, 220 fonts, WebRTC and timezone probes, scored against the TLS/HTTP/ASN view of the same request. Use when asked to run a browser fingerprint test, see what a fingerprint looks like,…

    by liarjsdev/liarjs-skills

    Needs (stated): Node.js

    81,196 · popularity
    View Agent Skill
  9. Rank 17
    Possible

    agent-browser

    Browser automation for AI agents via inference.sh. Navigate web pages, interact with elements using @e refs, take screenshots, record video. Capabilities: web scraping, form filling, clicking, typing, drag-drop, file upload, JavaScript execution. Use for: web automation, data extraction, testing,…

    by 101-skills/superpowers

    131,791 · popularity
    View Agent Skill
  10. Rank 18
    Possible

    github-issue-creator

    Official

    Convert raw notes, error logs, voice dictation, or screenshots into crisp GitHub-flavored markdown issue reports. Use when the user pastes bug info, error messages, or informal descriptions and wants a structured GitHub issue. Supports images/GIFs for visual evidence.

    by microsoft/skills

    • Report
    View Agent Skill
  11. Rank 19
    Possible

    docx

    Official

    Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files) or Word templates (.dotx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', '.dotx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx or .dotx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.

    by anthropics/skills

    View Agent Skill
  12. Rank 20
    Possible

    xlsx

    Official

    Use this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .xltx, .csv, or .tsv file (e.g., adding columns, computing formulas, formatting, charting, cleaning messy data); create a new spreadsheet from scratch or from other data sources; or convert between tabular file formats. Trigger especially when the user references a spreadsheet file by name or path — even casually (like \"the xlsx in my downloads\") — and wants something done to it or produced from it. Also trigger for cleaning or restructuring messy tabular data files (malformed rows, misplaced headers, junk data) into proper spreadsheets. The deliverable must be a spreadsheet file. Do NOT trigger when the primary deliverable is a Word document, HTML report, standalone Python script, database pipeline, or Google Sheets API integration, even if tabular data is involved.

    by anthropics/skills

    View Agent Skill
What this topic covers

What this topic covers

Each sub-topic groups Agent Skills for a specific situation.

Scope & rules
What you are allowed to touch, and what gets you in trouble.
Recon
Map what actually exists before poking it.
Find & prove
A working demonstration, not a theory.
Report
Enough for a defender to reproduce and fix.
Disclosure
When (and whether) the rest of the world hears.
Triage & bounty
The program's side: is this real, in scope, and worth paying?
Frequently asked questions

Frequently asked questions

How is this list ordered?
It is ranked by observed search demand, with direct matches for the topic placed first and a cap on how many skills any single publisher can occupy.
Which stage should I start with if I am new to bounty work?
Start with scope and rules, because the orientation of a bounty is a disclosure process where rules protect both sides. Recon and find-and-prove skills assume you already know what you are allowed to touch.
Do these skills cover the program side of a bounty?
Yes. Triage and bounty is one of the sub-topics: deciding whether a report is real, in scope, and worth paying. That sits alongside the researcher-side stages of recon, find and prove, report, and disclosure.
What separates a find-and-prove skill from a report skill?
Find and prove is about producing a working demonstration rather than a theory. Report is about giving a defender enough to reproduce and fix the issue, which is a different output from the proof itself.

How to install an Agent Skill

Start with the first skill on this page. Claude Code reads a SKILL.md once it is in the skills directory:

  • Claude Code — copy the SKILL.md for penetration-testing-with-strix into ~/.claude/skills/penetration-testing-with-strix/ for yourself, or .claude/skills/penetration-testing-with-strix/ to share it with a project.
  • From the registry — run npx skills add usestrix/strix@penetration-testing-with-strix.
  • Or download penetration-testing-with-strix from its source and place that SKILL.md in the directory above.

How to choose Check the source and the skill’s own instructions before you install. Official and Notable describe where a skill comes from.