Bug Bounty Pipeline

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 1.0.0

Overview

This skill is for bug bounty work, but it automates aggressive vulnerability scanning without enforceable scope or rate safeguards.

Install only if you will run it in a controlled security-testing environment with written authorization for every target. Add a machine-readable scope allowlist, block excluded and private ranges unless explicitly authorized, lower and enforce scan rates, require confirmation before active scans, and treat CVE enrichment APIs as potential disclosure of assessment metadata.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:126

Finding

Active Scanning Is Not Constrained by a Programmatic Scope Allowlist

Content

View full analysis

/dev/null done < "$TARGETS_FILE" # Nmap — vulnerability scripts echo "[2/4] Nmap vuln scripts..." while IFS= read -r target; do [ -z "$target" ] && continue nmap --script vuln "$target" -oN "$OUTDIR/nmap-vuln-$target.txt" 2>/dev/null done < "$TARGETS_FILE" ``` The security guidance at lines 563–564 states: ```text - **Scope whitelist is absolute.** Never scan outside program scope. - **Rate limiting mandatory.** Max 2-5 req/s per target. ``` ### Technical Analysis The pipeline immediately performs full-port service detection and vulnerability-script scanning against every entry in a caller-provided target file. The stated scope whitelist is only documentation: the implementation does not load a machine-readable bounty scope, verify domain ownership, validate approved CIDR ranges, reject excluded assets, or require authorization before active scanning. The orchestrator also invokes additional active scanners against caller-provided targets and URLs. Consequently, a malformed, stale, or malicious target list can cause the system to scan unrelated infrastructure. The Nmap option `--min-rate 1000` requests a minimum packet rate far above the documented mandatory limit of two to five requests per second. This increases the likelihood of service disruption, defensive alerts, IP blocking, and violation of bug-bounty rules. ### Attack Path 1. An operator, automation source, or malicious contributor adds an unauthorized hostname or IP address to `targets.txt`. 2. The operator starts the Hunter-Killer orchestrator. 3. Tier 2 reads the entry without checking it ...[truncated 1104 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:126

Finding

Unvalidated Targets Permit Nmap Option Injection

Content

View full analysis

/dev/null done < "$TARGETS_FILE" # Nmap — vulnerability scripts echo "[2/4] Nmap vuln scripts..." while IFS= read -r target; do [ -z "$target" ] && continue nmap --script vuln "$target" -oN "$OUTDIR/nmap-vuln-$target.txt" 2>/dev/null done < "$TARGETS_FILE" ``` ### Technical Analysis Shell quoting prevents word splitting and glob expansion, but it does not prevent a command-line value beginning with `-` from being interpreted as an option by the invoked program. The script does not validate that each line is a hostname or IP address and does not use an end-of-options marker before the target. A crafted target entry can therefore be parsed by Nmap as an additional option rather than as a scan destination. The same untrusted value is incorporated into an output filename. Path separators and other filename metacharacters can produce unexpected directory structures, output failures, or collisions, even where straightforward arbitrary-file writing is prevented by the fixed `nmap-` prefix and filesystem layout. The practical severity depends on whether an attacker or untrusted data source can modify the target list and on the capabilities of the installed Nmap version and NSE environment. ### Attack Path 1. An attacker gains the ability to supply or modify a target-list entry, such as through an imported scope file or shared automation input. 2. The attacker inserts a value beginning with an Nmap option prefix instead of a valid hostname or IP address. 3. Tier 2 reads the value without syntactic validation. 4. The quoted value remains a single argument but is interpreted ...[truncated 963 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:411

Finding

Unescaped Report Fields Are Injected into a Sed Program

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match
• Confidence: 97% confidence

Finding

This skill operationalizes offensive security tooling such as Nmap vuln scripts, Nikto, OpenVAS, ZAP, Wapiti, and nuclei into an automated 'Hunter-Killer' workflow intended to discover exploitable conditions at scale. In context, the danger is not merely tool reference but the turnkey automation of active scanning against operator-supplied targets, which can enable unauthorized reconnaissance, service disruption, or abusive dual-use behavior if scope enforcement fails or is ignored.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md

S_FILE="${1:?Usage: $0 <targets.txt>}"
OUTDIR="$HOME/App/domains/argus/reports/bounty/$(date +%Y%m%d-%H%M%S)-scan"
mkdir -p "$OUTDIR"

echo "=== TIER 2: Network Scanning ==="
echo "Targets: $(wc -l < "$TARGETS_FILE")"
echo "Output: $OUTDIR"
echo ""

# Nmap — quick port scan
echo "[1/4] Nmap port scan..."
while IFS= read -r target; do
  [ -z "$target" ] && continue
  echo "  Scanning: $target"
  nmap -sV -sC -T4 -p- --min-rate 1000 "$target" -oN "$OUTDIR/nmap-$target.txt" 2>/dev/null
done < "$TARGETS_FILE"

# Nmap — vulnerability scripts
echo "[2/4] Nmap vuln scripts..."
while IFS= read -r target; do
  [ -z "$target" ] && continue
  nmap --script vuln "$target" -oN "$OUTDIR/nmap-vuln-$target.txt" 2>/dev/null
done < "$TARGETS_FILE"

# OpenVAS (if installed)
echo "[3/4] OpenVAS scan..."
if command -v gvm-cli &>/dev/null; then
  while IFS= read -r target; do
    [ -z "$target" ] && continue
    gvm-cli socket --xml "<create_task>...</create_task>" 2>/dev/null
  done < "$TARGETS_FILE"
e

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill immediately presents a high-volume recon/scanning pipeline without an upfront safety warning, scope gate, or consent checkpoint, despite automating network enumeration and HTTP probing. In this context, that omission is dangerous because it increases the likelihood of unauthorized scanning, accidental impact on third-party systems, and misuse by operators who may not appreciate the legal and operational consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The enrichment step sends discovered CVE identifiers to a local HTTP service without any authentication, transport protection, or trust boundary validation. In a hostile or multi-tenant environment, a spoofed or compromised localhost service could capture scan-derived intelligence, return malicious payloads, or manipulate triage output; because the skill processes findings from potentially sensitive targets, even metadata leakage can be operationally significant.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md

while IFS= read -r cve_id; do
  [ -z "$cve_id" ] && continue

  result=$(curl -s -X POST "http://localhost:8765/cve-mcp/lookup" \
    -H "Content-Type: application/json" \
    -d "{\"cve_id\": \"$cve_id\"}" 2>/dev/null)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The EPSS enrichment code transmits enumerated CVE IDs to an external third-party API, creating outbound disclosure of vulnerability intelligence derived from scans. Even though CVE IDs are public identifiers, the specific set being queried can reveal what technologies and weaknesses were observed on targets, which is sensitive in a bug-bounty or internal assessment context.

Content

Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.

md

if cves:
    cve_list = ",".join(cves[:50])  # EPSS API limit
    url = f"https://api.first.org/data/v1/epss?cve={cve_list}"
    try:
        with urllib.request.urlopen(url, timeout=10) as resp:
            data = json.loads(resp.read())

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The section says 'Run the complete Hunter-Killer Loop' and the manifest describes the full workflow through bug bounty payouts, but hunter-killer.sh only runs Tiers 1 through 5 and stops before Tier 6 submission. This is an active contradiction between the inline documentation and the code behavior, not just an omitted detail.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest and documentation position the skill as covering the full 'discovery-to-payout workflow' and explicitly mention 'ZK-Bankir integration: auto-track bounty income' plus a ZKBANKIR_API configuration value. However, none of the provided scripts call that API or perform any payout tracking, so the capability is unjustified by the actual code shown and overstates the implemented scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The 'Macro thesis' line frames usage around 'US vs China,' EU AI Act enforcement, and a monetized target narrative, imposing a particular political/geopolitical framing in the skill's natural-language guidance. This is not presented as optional context or justified as a region-specific compliance requirement.

Content

No source excerpt is available for this finding.