BF bug-reaper

• low Risky intent intent-offensive-security CHANGELOG.md:63
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - 32-file structured web2 bug bounty agent skill

• low Risky intent intent-offensive-security README.md:3
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  > Structured web2 bug bounty AI skill — 18 vulnerability classes, 4 bug bounty platforms, zero AI slop. Compatible with OpenClaw, Cursor, Claude Code, Antigravity, and Windsurf.

• low Risky intent intent-offensive-security README.md:15
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  BugReaper is an [Agent Skill](https://agentskills.io) that turns any compatible AI agent into a disciplined web2 bug bounty hunter. It enforces evidence-based validation, simulates real triage for Hac

• low Risky intent intent-offensive-security README.md:74
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)

  The skill auto-triggers when you mention `bug bounty`, `pentest`, `find vulnerabilities`, or any vulnerability class name in your agent conversation.

  quoted
• low Risky intent intent-offensive-security references/audit-rules.md:1
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  # Audit Rules — Web2 Bug Bounty

  detector
• low Risky intent intent-offensive-security references/audit-rules.md:3
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  Strict filtering for findings that pass real bug bounty triage. Read this BEFORE auditing any target.

• low Risky intent intent-offensive-security references/chaining.md:133
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  ### 🔗 Chain 7: IDOR + Mass Assignment → Privilege Escalation

• low Risky intent intent-offensive-security references/exploit-validation.md:72
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - User role → Admin function (privilege escalation)

• low Risky intent intent-offensive-security references/platforms/bugcrowd.md:71
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - Privilege escalation: [what access gained beyond intended]

• low Risky intent intent-offensive-security references/source-code-audit.md:5
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  > **Authorization:** Source code review must still target programs where you have permission to test (active bug bounty program, OSS program, or explicit written authorization).

  detector
• low Exfiltration read-dotenv references/source-code-audit.md:162
  Reads a .env file (documentation of a security skill)

  cat .env .env.local .env.development .env.production 2>/dev/null

  security skill
• low Risky intent intent-offensive-security references/vulnerabilities/auth-bypass.md:12
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  | Privilege escalation | Role parameter manipulation, JWT claim forgery |

• low Risky intent intent-offensive-security references/vulnerabilities/csrf.md:26
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - Add admin user → privilege escalation

• low Risky intent intent-offensive-security references/vulnerabilities/open-redirect.md:7
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  **Standalone open redirect is generally LOW severity.** It becomes **Medium–High** when chained with other vulnerabilities (OAuth token theft, credential harvesting via trusted domain, etc.).

  detector
• low Risky intent intent-offensive-security references/vulnerabilities/open-redirect.md:63
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  **Most bug bounty programs will reject bare open redirects unless chained.** Always look for an auth context: OAuth, password reset, login flow, email verification.

• low Risky intent intent-offensive-security references/vulnerabilities/open-redirect.md:91
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - Full exploit chain documented step by step

• low Dangerous commands cmd-eval-dynamic references/vulnerabilities/rce.md:27
  Dynamic code execution from decoded/untrusted input (documentation of a security skill)

  os.system(f"ping {user_input}")

  security skill
• low Exfiltration exfil-webhook-url references/vulnerabilities/ssrf.md:30
  Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)

  Example: `url=https://YOUR-COLLABORATOR-ID.oast.pro`

  placeholder
• low Secrets in code secret-high-entropy-token references/vulnerabilities/ssrf.md:78
  High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)

  `curl -X PUT "http://[cloud-imds-ip]/latest/api/token" -H "X-aw…ds: 21600"`

  quoted
• low Risky intent intent-offensive-security references/vulnerabilities/xss.md:64
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  | Admin panel | Admin account compromise, lateral movement |

• low Risky intent intent-offensive-security references/waf-bypass.md:234
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  ## Important Notes for Bug Bounty

• low Risky intent intent-offensive-security SKILL.md:10
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  description: "Web2 bug bounty hunting agent — evidence-based vulnerability finder and report writer. Use when: auditing web apps/APIs for HackerOne, Bugcrowd, Intigriti, YesWeHack; hunting XSS, SQLi, 

  detector
• low Risky intent intent-offensive-security SKILL.md:13
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  # Web2 Bug Bounty Agent

• low Risky intent intent-offensive-security SKILL.md:15
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  You are a senior offensive security researcher and bug bounty hunter. Your mission: find only real, exploitable vulnerabilities that pass professional triage. No guessing. No speculation. No false pos

• low Risky intent intent-offensive-security SKILL.md:30
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  > **WARNING — Authorization required.** Only proceed against targets covered by an active bug bounty program scope or with explicit written permission. Ask the user to confirm the target is in scope b

  detector
• low Risky intent intent-offensive-security SKILL.md:51
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  3. **`role` / `admin` / `isAdmin` in API responses:** If returned in your own profile API, try adding it to a PUT/PATCH request. Mass assignment → privilege escalation.

A further 1 matches are quotations in this security skill's documentation and are not counted as findings.