hunt-toolkit

Install a reasoning-first security-research toolkit into Claude Code with one npx command. Hunt novel bugs in any authorized open-source codebase or live web / mobile / network target.

A bug is the gap between what the developer assumed and what the system enforces.

⚠️ Authorized testing only. These skills assume you have written permission to test the target. They will refuse a target with no authorized scope. Staying in scope and within the law is your responsibility.

Usage

npx @youssef3id/hunt-toolkit --list                    # list every bundled skill
npx @youssef3id/hunt-toolkit --all                     # install all skills into ./.claude/skills
npx @youssef3id/hunt-toolkit --all --global            # install into ~/.claude/skills (all projects)
npx @youssef3id/hunt-toolkit --skill source-audit      # install one skill
npx @youssef3id/hunt-toolkit --skill source-audit,web-ssrf-test,web-access-control-test
npx @youssef3id/hunt-toolkit --skill all --global --force   # overwrite existing copies

By default skills install into ./.claude/skills (the current project). Add --global to install into ~/.claude/skills for every project. --force overwrites skills that are already present.

What you get

• source-audit — the end-to-end pipeline for any codebase: choose-target → variant-hunt (pin version + CVE dedupe) → understand-target → hunt-unknown → per-class playbook → repro-lab → report → triage.
• Per-class playbooks — access-control (IDOR/BOLA/BFLA), auth/ATO, SSRF, injection, race, business-logic, XSS, plus web / Android / network recon and reporting.
• Core methodology — understand-target, variant-hunt, hunt-unknown, senior-hunt, reasoning-first-research, hunt-notebook, human-writeup.
• WordPress specialization — patchstack-hunt, pick-target, theme-hunt, wp-lab.

Run npx @youssef3id/hunt-toolkit --list for the full set.

Using the skills

After installing, restart Claude Code (or run /skills). The skills load automatically when relevant — or ask Claude directly, e.g. "use the source-audit skill to hunt this repo" or "run understand-target on this codebase".

License

MIT. Provided for authorized, lawful security work only.