security-bounty-hunter

Use it when:: You're preparing a Huntr or HackerOne submission and want findings that pay, not theoretical risks.
It does:: Checks the program's scope, finds real entry points, uses Semgrep only for triage, and follows user input end to end to a dangerous sink.
You get:: A report with description, vulnerable code, proof of concept, impact and affected version, once a quality gate passes.
Unlike ECC's security-review:: This one skips best-practice gaps and drops local-only findings, missing headers and self-XSS that programs reject.

Test only targets you own or that a bounty program's scope authorizes you to test.

TL;DR

A triage-first workflow for responsible disclosure. It keeps to issues bounty programs pay for: SSRF through user-controlled URLs, auth bypass in middleware, remote deserialization or upload-to-RCE paths, reachable SQL and command injection, path traversal in file serving, and auto-triggered XSS, each with its CWE. It drops what platforms usually reject: local-only pickle or torch.load, eval in CLI tools, shell=True on hardcoded commands, missing headers alone, rate-limit complaints without impact, self-XSS, out-of-scope CI injection and test or demo code. The steps: read the program's rules and SECURITY.md, find real entry points such as handlers, uploads, webhooks and parsers, run static tools like Semgrep only as triage input, read the code path end to end, prove user input reaches a meaningful sink, confirm with the smallest safe proof of concept, and check for duplicates. Before submitting, a gate checks reachability, user control, a working PoC, no existing advisory or CVE, and that the target is in scope.

Summarizes the skill at d2ef268.

npx skills add https://github.com/affaan-m/ecc --skill security-bounty-hunter

skills.sh page Source on GitHub All skills from affaan-m/ecc

Weekly Downloads week to Nov 9, 2026

455

+76% in 8 weeks

More weekly downloads than 62% of skills

Weekly values

Week to	Installs
Sep 21	259
Sep 28	166
Oct 5	157
Oct 12	244
Oct 19	414
Oct 26	408
Nov 2	476
Nov 9	455

Total Downloads on skills.sh

5,500

Fewer downloads than 84% of skills

Repo stars affaan-m/ecc

299,776

More stars than 97% of repos

Age published May 19, 2026

5 months

Newer than 66% of skills

Category	category:security category:software-engineering Compliance, guardrails, skill vetting and browser fingerprinting. Everything for building software: planning, coding, debugging, design, frameworks, cloud, agents and skills.
Type	type:workflow A multi-step process the agent follows: interview, debug, run a TDD loop, review.
Effect	effect:local Its own steps create or change files, git state or local tools.
Needs	needs:none Instructions only. Works in any agent that supports skills.
Publisher	by:community Everyone else. Unverified vendor claims default to community.
Topics	security code-review

SKILL.md

From affaan-m/ecc at d2ef268. Checked daily, last changed Nov 6, 2026.

Frontmatter

name: security-bounty-hunter
description: Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings. Use when hunting reportable, remotely reachable vulnerabilities in a repository.
metadata:
  version: "1.0.0"
  origin: ECC direct-port adaptation

Security Bounty Hunter

Use this when the goal is practical vulnerability discovery for responsible disclosure or bounty submission, not a broad best-practices review.

When to Use

Scanning a repository for exploitable vulnerabilities
Preparing a Huntr, HackerOne, or similar bounty submission
Triage where the question is "does this actually pay?" rather than "is this theoretically unsafe?"

How It Works

Bias toward remotely reachable, user-controlled attack paths and throw away patterns that platforms routinely reject as informative or out of scope.

In-Scope Patterns

These are the kinds of issues that consistently matter:

Pattern	CWE	Typical impact
SSRF through user-controlled URLs	CWE-918	internal network access, cloud metadata theft
Auth bypass in middleware or API guards	CWE-287	unauthorized account or data access
Remote deserialization or upload-to-RCE paths	CWE-502	code execution
SQL injection in reachable endpoints	CWE-89	data exfiltration, auth bypass, data destruction
Command injection in request handlers	CWE-78	code execution
Path traversal in file-serving paths	CWE-22	arbitrary file read or write
Auto-triggered XSS	CWE-79	session theft, admin compromise

Skip These

These are usually low-signal or out of bounty scope unless the program says otherwise:

Local-only pickle.loads, torch.load, or equivalent with no remote path
eval() or exec() in CLI-only tooling
shell=True on fully hardcoded commands
Missing security headers by themselves
Generic rate-limiting complaints without exploit impact
Self-XSS requiring the victim to paste code manually
CI/CD injection that is not part of the target program scope
Demo, example, or test-only code

Workflow

Check scope first: program rules, SECURITY.md, disclosure channel, and exclusions.
Find real entrypoints: HTTP handlers, uploads, background jobs, webhooks, parsers, and integration endpoints.
Run static tooling where it helps, but treat it as triage input only.
Read the real code path end to end.
Prove user control reaches a meaningful sink.
Confirm exploitability and impact with the smallest safe PoC possible.
Check for duplicates before drafting a report.

Example Triage Loop

semgrep --config=auto --severity=ERROR --severity=WARNING --json

Then manually filter:

drop tests, demos, fixtures, vendored code
drop local-only or non-reachable paths
keep only findings with a clear network or user-controlled route

Report Structure

## Description
[What the vulnerability is and why it matters]

## Vulnerable Code
[File path, line range, and a small snippet]

## Proof of Concept
[Minimal working request or script]

## Impact
[What the attacker can achieve]

## Affected Version
[Version, commit, or deployment target tested]

Quality Gate

Before submitting:

The code path is reachable from a real user or network boundary
The input is genuinely user-controlled
The sink is meaningful and exploitable
The PoC works
The issue is not already covered by an advisory, CVE, or open ticket
The target is actually in scope for the bounty program