Skills Bundle

Bug Bounty Automation

Name: Bug Bounty Automation
Brand: lib-pro
SKU: bug-bounty-automation
Price: 60.00 GBP
Availability: InStock

The methodology + tooling to ship real submissions, not 'run subfinder'.

A system that ships real submissions, not a list of tools to run.

See use cases ↓

One-time paymentLifetime updatesCommercial license

Skills

281 KB

Methodology content

Worked examples

Adapters

What you'll be able to do

Concrete outcomes, not vague promises.

Your first bug bounty submission

Signed up for HackerOne, stared at the target, didn't know where to start. The bb-methodology skill gives you the discipline.

First report submitted within 2 weeks.

Scaling from 1 to 5 programs

Currently hunting one program at a time. The pipeline + ops skill lets you run parallel recon across multiple targets.

5x more reconnaissance, same time investment.

Client security audits

Selling pentest services. The methodology + reporting framework gives you repeatable, defensible audit results.

Reusable audit playbooks you can run junior consultants through.

Web3-specific hunting

Solidity + smart contract vulnerabilities are a different game. The web3-audit skill covers reentrancy, access control, MEV.

A new revenue stream in a less-saturated market.

Built for

If any of these are you, this is for you.

New hunters who signed up but don't know where to startPart-time hunters who want to ship more reports without burning outSecurity consultants who want reusable methodologyAI coders who want the methodology baked into their workflowSolo founders looking for a high-leverage side income

Built withpi-agentsubfinderhttpxnucleiSQLiteLlama 3 8BMarkdown

Why this playbook works

Three things that make this different from a wall of prompts.

Methodology, not a workflow

These skills name the moves: explore, design, apply, verify. Once you have the words, you stop arguing about steps and start shipping.

Top 1% thinking patterns

The persona pattern and anomaly-detection rubric are what separates a scanner from a hunter. The skills teach both.

Real submissions, real payouts

Worked example: a P1 account-takeover via CORS misconfiguration, triaged in 4 hours, paid $5,000 in 5 days. Redacted, but the methodology is real.

Quick start

Drop the package into your project and start using the commands.

terminal

$tar -xzf bug-bounty-automation-0.2.0.tgz && cd bug-bounty-automation-0.2.0 && ./scripts/init.sh

$# Extract + initialise

$./scripts/init.sh

$# Edit .env + your target config

$make start TARGET=my-program DAG=recon

$# Skills work in pi-agent, Claude Code, Cursor, Cline, Aider

What's in the box

21 skills
281 KB of methodology
Recon pipeline
subfinder → httpx → nuclei → triage
SQLite schema
subdomains, responses, findings, triage, reports
LLM provider config
OpenAI, Anthropic, local — $0–$50/mo
Docker stack
swarm-deployable
Real worked example
P1 account takeover, redacted
Claude Code adapter
.claude/commands + CLAUDE.md
Cursor / Cline / Aider adapters
drop-in rules

Everything in the pack

What you get the moment your payment clears.

bb-methodology skill — master orchestrator + 5-phase non-linear workflow

bug-bounty skill — program navigation, scope rules, payment tiers

web2-recon + web2-vuln-classes — 24 KB of hunt-tested recon methodology

triage-validation skill — eliminate false positives before reporting

report-writing skill — templates that get accepted on first submission

threat-model + credential-attack + coverage — advanced playbooks

3 platform-specific skills — HackerOne, Intigriti, YesWeHack rules

Working recon pipeline (subfinder → httpx → nuclei → LLM triage → report)

Sample target walkthrough with a redacted P1 report

Adapters for Claude Code, Cursor, Cline, Aider

Web3 + meme-coin audit methodologies (lucrative niches)

$0–$50/mo operating budget — small LLM for triage, free static recon

Adapters included

These skills were authored for pi-agent, but we include drop-in adapters for the major AI coding tools.

Tool	Adapter location	What you get
pi-agent	`adapters/pi-agent/`	SKILL.md files for the host's ~/.pi/agent/skills/
Claude Code	`adapters/claude-code/`	CLAUDE.md + slash commands
Cursor	`adapters/cursor/`	.cursorrules rule sets
Cline / Continue	`adapters/cline/`	System-prompt rules
Aider / generic	`adapters/generic/`	INSTRUCTIONS.md snippets

Same playbook, different packaging. The adapters translate the methodology into the format each tool expects. Install once, swap agents without re-learning the method.

Full documentation

Everything in the package, every prop, every pattern.

Bug Bounty Automation

The methodology + tooling you'll use to ship real bug bounty reports in days, not months.

Built and battle-tested. 21 skills covering the full hunting workflow. Recon pipeline that runs unattended. Worked example of a real P1 find.

What's Inside

Skill	Purpose
bb-methodology	Master orchestrator — 5-phase non-linear workflow + critical thinking framework
bug-bounty	Program navigation, scope rules, payment tiers
bb-personas	Top-1% hunter thinking patterns — dev psychology, anomaly detection
bb-toolbox	Tooling decision tree — what to use when, why this over that
bug-bounty-ops	Daily/weekly operations — pipeline orchestration, anti-patterns
web2-recon	Recon methodology — subdomain enum, port scan, fingerprint, prioritisation
web2-vuln-classes	Web2 vulnerability reference — IDOR, BOLA, SSRF, SSTI, race conditions
triage-validation	Validate findings before reporting — eliminate false positives
evidence-reporting	Capture evidence correctly — screenshots, request/response, chains
report-writing	Report templates that get accepted on first submission
threat-model	Threat modeling for unfamiliar targets
security-arsenal	Tools of the trade — beyond the popular 5
credential-attack	Credential stuffing / leakage methodology
coverage	Asset coverage methodology — when you've actually tested everything
cve-research	Mapping CVEs to your target
dep-sca	Dependency / supply chain attack methodology
llm-scorecard	When to use LLMs in triage vs when to trust your eyes
bug-bounty-intigriti	Intigriti-specific scope rules, payout structure
bug-bounty-yeswehack	YesWeHack-specific — public program access, response times
web3-audit	Web3 smart contract audit methodology
meme-coin-audit	The very specific (and lucrative) world of meme-coin launches

Quick Start

# 1. Extract
tar -xzf bug-bounty-automation-0.2.0.tgz
cd bug-bounty-automation-0.2.0

# 2. Set up environment
./scripts/init.sh
cp .env.example .env
vim .env                                # your API keys go here

# 3. Configure a target
cp config/targets/example.yaml config/targets/my-program.yaml
vim config/targets/my-program.yaml

# 4. Run a manual pipeline
make start TARGET=my-program DAG=recon

# 5. Drop skills into your AI coder
cp -r skills/* ~/.claude/skills/         # or wherever your tool reads them

Adapters Included

Works in every major AI coding tool:

Tool	Adapter location	What you get
pi-agent	`adapters/pi-agent/`	Direct copy of the SKILL.md files
Claude Code	`adapters/claude-code/`	`CLAUDE.md` + slash commands
Cursor	`adapters/cursor/`	`.cursorrules` rule sets
Cline / Continue	`adapters/cline/`	System-prompt rules
Aider / generic	`adapters/generic/`	`INSTRUCTIONS.md` snippets

The Core Idea

You are the hunter. The skills are the system.

Bug bounty is not "find a bug." It's "prove an attack scenario." The methodology teaches you how to think like an attacker with a specific goal, not a scanner looking for patterns. The pipeline collects the data so you can focus on the high-leverage work.

Operating Cost

The pipeline is designed for $0–$50/month cloud spend. Static recon tools (subfinder, httpx, nuclei) are free. The LLM triage step uses a small model on tight budget caps. Most hunters run at $0–$10/mo via a local 4B model.

Worked Example

examples/ ships with a real walkthrough — a sample target, the recon run, the triage output, and the actual report that was submitted (program name redacted). The example: a P1 account-takeover via CORS misconfiguration, triaged in 4 hours, paid $5,000 in 5 days.

What's in the download

A .tgz containing:

bug-bounty-automation-0.2.0/
├── README.md              ← setup guide
├── OVERVIEW.md            ← positioning
├── LICENSE.md
├── skills/                ← 21 skills (SKILL.md each)
├── pipeline/main.py        ← recon pipeline
├── db/schema.sql           ← SQLite state store
├── config/                 ← pipeline + LLM configs
├── scripts/init.sh         ← one-shot setup
├── docker/                 ← container + swarm stack
├── adapters/               ← drop-in for AI coders
├── examples/               ← redacted P1 walkthrough
├── docs/architecture.md
├── requirements.txt
└── Makefile

Updates

Free for life. Re-download for new methodologies, new platform patterns, new vuln classes.

What This Isn't

It's not a vuln scanner. You are the hunter.
It's not a money button. Bug bounty is real work.
It's not a license to test unscoped targets. Read each program's rules.

Common questions

Things people ask before buying.

Is this for beginner bug bounty hunters?

It's for anyone who has signed up for a program and doesn't know where to start. The methodology assumes you understand HTTP, basic dev tools, and reading code. It does NOT assume you've ever submitted a report.

Will the methodology work for HackerOne / Intigriti / YesWeHack?

Yes. Three platform-specific skills ship (HackerOne, Intigriti, YesWeHack) covering scope rules, submission patterns, and response-time expectations. The core methodology is platform-agnostic.

What's the operating cost?

$0–$50/month depending on how many targets you run. Static recon (subfinder, httpx, nuclei) is free. The LLM triage step uses a small model on tight budget caps. Most hunters run at $0–$10/mo by using a local 4B model.

Does this work for Web3 / smart contract audits?

Yes. The web3-audit skill covers reentrancy, access control, MEV, and the unique tooling of smart contract hunting. The meme-coin-audit skill digs into the very specific (and lucrative) world of token launches.

Do I need to run the pipeline to use the skills?

No. The skills are the methodology. The pipeline is a tool that uses the methodology. You can read the skills yourself, run recon by hand, or load them into an AI coder for guidance.

What does the worked example show?

A redacted walkthrough of a real engagement — the recon run, the triage findings, the actual report that was submitted. The program name is anonymised but the methodology, evidence, and impact are genuine.

£60 — lifetime

One purchase. Yours forever.

Pay once via Stripe. Get the complete package instantly. Free updates for the same major version. Commercial license included.

Secure payment via Stripe · Instant download · 30-day money-back if it doesn't save you time