An autonomous bug bounty hunting and vulnerability scanning skill featuring multi-stage LLM analysis and strict scope safety.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install bounty-hunter-pro
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install bounty-hunter-pro using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Bounty Hunter Pro?
Bounty Hunter Pro is a robust security automation framework designed for the Openclaw Skills ecosystem. It streamlines the process of bug bounty hunting by automating subdomain enumeration, secret discovery, and vulnerability scanning within a strictly defined authorized scope. By combining traditional security tools with modern LLM analysis, it provides a high-signal security posture assessment for developers and security researchers alike.
This skill ensures that security testing remains ethical and efficient by verifying every target against a pre-authorized list. Within the context of Openclaw Skills, Bounty Hunter Pro acts as a vigilant guardian, scanning targets and notifying the user of potential risks via an integrated message bus. It effectively bridges the gap between raw scanning data and actionable security intelligence.
Bounty Hunter Pro Use Cases
- Automating subdomain discovery for authorized bug bounty programs.
- Detecting exposed API keys and secrets in public-facing JavaScript files.
- Performing continuous security monitoring and audits for corporate web assets.
- Triaging vulnerabilities using multi-level LLM analysis to reduce manual review time.
How Bounty Hunter Pro Works
- The skill first checks the target domain against the authorized_targets.txt file to ensure strict legal and ethical compliance.
- It performs automated subdomain discovery using Certificate Transparency logs via the nightwatch.py component.
- The system scans each discovered target for misconfigurations and exposed secrets using subfinder, httpx, and nuclei.
- Findings are fed into an analyze_daemon which applies entropy filtering to remove false positives and noise.
- A two-stage LLM analysis (utilizing fast and deep models) evaluates the severity and impact of each discovery.
- The watchdog.py component monitors for critical severity results and broadcasts alerts through the internal message bus.
- A final structured Markdown report is generated and stored in a date-stamped directory for review.
Bounty Hunter Pro Setup
# Navigate to the tools directory and prepare the scanning binaries
cd ~/workspace/bounty_hunting/tools
unzip subfinder.zip
unzip httpx.zip
unzip nuclei.zip
# Configure your authorized scan scope to ensure safety
echo "example.com" > ~/workspace/bounty_hunting/authorized_targets.txt
echo "*.example.com" >> ~/workspace/bounty_hunting/authorized_targets.txt
Bounty Hunter Pro Data Schema & Taxonomy
| File or Directory | Description |
|---|---|
authorized_targets.txt |
A strict whitelist of domains authorized for scanning activities. |
findings_incremental.json |
A JSON data store for raw scanner results prior to analysis. |
live_analysis.md |
A real-time document containing ongoing LLM-powered vulnerability assessments. |
reports/security/[TARGET]/ |
The output directory for final, categorized Markdown security reports. |
tools/ |
Contains the core binaries for subfinder, httpx, and nuclei. |
Bounty Hunter Pro Advanced Features
- Entropy-based secret detection to distinguish between high-value API keys and random strings.
- Dual-stage LLM pipeline utilizing qwen2.5-coder and glm-5 for high-accuracy vulnerability triaging.
- Automated cron job integration for performing scheduled security scans during low-traffic periods.
- Real-time notification system via the Openclaw Skills message bus for immediate critical threat alerts.
- High-performance multi-threaded scanning engine supporting up to 10 concurrent workers by default.
SKILL.md
Loading
Related Openclaw Skills
Pipelock Security Harness
A security-focused HTTP proxy that protects AI agents from data exfiltration, secret leaks, and malicious injections.
Todo Management
A lightweight, per-workspace SQLite todo manager operated via a dedicated shell script for seamless task tracking.
Web Search Skill
A high-performance skill that enables AI agents to query the internet for real-time information using the DuckDuckGo API.
SafeExec
Protect your system with an automated command interception and human-in-the-loop approval workflow for AI agent shell operations.
WalletLens
An advanced multi-chain wallet analyzer providing USD valuations, ENS resolution, and sophisticated bot detection for EVM networks.
CRM Data Cleaner
An AI-powered framework for deduplicating, normalizing, and enriching CRM contacts and companies to ensure pristine data hygiene.
Featured*
