All triggered automatically by topic — describe what you're testing in plain English and the relevant skill loads. No invocation by name.

51 skills · 15 commands · 574+ disclosed reports curated · 6-phase workflow · exercised against public training platforms (DVWA, OWASP Juice Shop, Hacker101, testphp.vulnweb.com) and calibrated through authorized real-world engagements.

Scope — what this bundle is for, and what it isn't

This bundle covers the external attack surface — anything reachable from the internet without first compromising an internal endpoint.

In scope

• Bug bounty hunting — web apps, APIs, SaaS, GraphQL, OAuth, JWT, file upload, IDOR, SSRF, RCE chains
• Web application pentesting — full hunt-* coverage of OWASP-mapped bug classes + discipline rules
• External red-team engagements — initial-access against internet-facing enterprise estate: M365 / Entra ID, Okta-as-IdP, SharePoint on-prem (ToolShell + legacy SOAP), VMware vCenter / Workspace ONE, SSL VPN appliances (Cisco / Fortinet / Citrix / Palo Alto / Pulse / SonicWall / F5), Android APK red-team, supply-chain recon
• Cloud misconfig + post-credential escalation — public S3, IMDS chains, STS AssumeRole, cross-account confused-deputy
• Recon + OSINT — subdomain enum, identity-fabric mapping, certificate transparency, JS analysis, secret scanning
• Reporting — H1, Bugcrowd (VRT-aware), Intigriti, Immunefi, plus client-facing red-team deliverable format

Out of scope (deliberate — not gaps, design decisions)

• Internal Active Directory attacks — BloodHound, Kerberoasting, ASREProast, DCSync, Pass-the-Hash, AD CS abuse, ntlmrelayx, Responder, PetitPotam, etc. Different operational risk profile; needs different tooling and judgment. Future bundle, not this one.
• C2 frameworks — Cobalt Strike, Sliver, Mythic, Havoc, BRC4 tradecraft. Out of scope for external-only engagement model.
• Post-exploit / persistence / lateral — Mimikatz/comsvcs LSASS dumping, golden/silver tickets, named-pipe impersonation, persistence (registry, scheduled tasks, WMI events, COM hijacking), token theft. These start after the perimeter has already broken — different bundle territory.
• Evasion — AMSI bypass, ETW patching, AV/EDR bypass. Tied to C2 tradecraft above.
• iOS pentesting / hardware / RF / ICS — out of scope by design.
• Binary exploitation / kernel pwn / browser internals — different skill universe.

If you're running an internal red team that includes domain-takeover chains via Kerberos or lateral movement, this bundle won't help you in those phases — and we'd rather say that up front than have you find out mid-engagement. The external surface handoff to internal-RT tooling (Impacket, NetExec, CrackMapExec, Rubeus, Certify, BloodHound) is intentionally outside our scope. Coverage for internal AD and post-exploit may come in a future update.

Capability Map

The 51 skills group into 7 capability domains. Each box below is a real skill on disk. Skills auto-load when their description keywords match what you're describing to Claude.

graph TB
    classDef recon fill:#FFE4D1,stroke:#DA7756,stroke-width:2px,color:#080705
    classDef hunt fill:#FFB591,stroke:#DA7756,stroke-width:2px,color:#080705
    classDef platform fill:#FF8B14,stroke:#DA7756,stroke-width:2px,color:#fff
    classDef redteam fill:#DA7756,stroke:#23201C,stroke-width:2px,color:#fff
    classDef workflow fill:#FFE4D1,stroke:#DA7756,stroke-width:2px,color:#080705
    classDef report fill:#FFB591,stroke:#DA7756,stroke-width:2px,color:#080705
    classDef cli fill:#23201C,stroke:#DA7756,stroke-width:2px,color:#FFE4D1

    subgraph SCOPE [" "]
        direction LR
        S1["Engagement scaffold<br/>hunt &lt;target&gt;<br/>bug-bounty · bb-methodology"]:::workflow
    end

    subgraph RECON ["Recon & Intelligence (3)"]
        direction TB
        R1["offensive-osint<br/>15-ref probe arsenal"]:::recon
        R2["web2-recon<br/>subdomain + endpoint enum"]:::recon
        R3["osint-methodology<br/>5-stage pipeline"]:::recon
    end

    subgraph HUNT ["Hunt — Web App (27 hunt-* skills)"]
        direction TB
        H1["Injection<br/>hunt-sqli · hunt-xss · hunt-ssti · hunt-rce"]:::hunt
        H2["Authorization<br/>hunt-idor · hunt-auth-bypass · hunt-csrf"]:::hunt
        H3["Server-Side<br/>hunt-ssrf · hunt-xxe · hunt-http-smuggling · hunt-cache-poison"]:::hunt
        H4["Identity<br/>hunt-jwt · hunt-saml · hunt-oauth · hunt-mfa-bypass · hunt-ato"]:::hunt
        H5["API & Modern<br/>hunt-graphql · hunt-api-misconfig · hunt-file-upload"]:::hunt
        H6["Business & Race<br/>hunt-business-logic · hunt-race-conditions · hunt-llm-ai · hunt-pii-leak"]:::hunt
    end

    subgraph PLATFORM ["Enterprise Platform Attack (7)"]
        direction TB
        P1["Identity Fabric<br/>m365-entra-attack · okta-attack"]:::platform
        P2["Cloud & Virt<br/>cloud-iam-deep · vmware-vcenter-attack"]:::platform
        P3["Perimeter Appliances<br/>enterprise-vpn-attack"]:::platform
        P4["SharePoint Ecosystem<br/>hunt-sharepoint · hunt-aspnet · hunt-ntlm-info"]:::platform
        P5["Mobile & Supply Chain<br/>apk-redteam-pipeline · supply-chain-attack-recon"]:::platform
    end

    subgraph REDTEAM ["Red Team Tradecraft (2)"]
        direction TB
        RT1["redteam-mindset<br/>DO NOT STOP directive<br/>operator discipline"]:::redteam
        RT2["mid-engagement-ir-detection<br/>SOC-patch & attacker-activity<br/>baseline-shift detection"]:::redteam
    end

    subgraph WORKFLOW ["Validation & Discipline"]
        direction TB
        V1["triage-validation<br/>7-Question Gate<br/>PASS / DOWNGRADE / KILL / CHAIN"]:::workflow
    end

    subgraph REPORT ["Capture & Report (3)"]
        direction TB
        E1["evidence-hygiene<br/>cookie redaction · PII black-bar"]:::report
        E2["report-writing<br/>H1 · Intigriti · Immunefi templates"]:::report
        E3["bugcrowd-reporting · redteam-report-template<br/>VRT mapping · DOCX deliverable"]:::report
    end

    subgraph CLI ["Slash Commands & CLI (15 + 1)"]
        direction LR
        C1["Slash: /recon /hunt /triage /report /validate /chain /autopilot /scope /surface /pickup /intel /remember /memory-gc /token-scan /web3-audit"]:::cli
        C2["cbh CLI: recon · classify · triage · report"]:::cli
    end

    SCOPE --> RECON
    RECON --> HUNT
    RECON --> PLATFORM
    HUNT --> WORKFLOW
    PLATFORM --> WORKFLOW
    REDTEAM -.applies throughout.-> HUNT
    REDTEAM -.applies throughout.-> PLATFORM
    WORKFLOW --> REPORT
    CLI -.routes into.-> RECON
    CLI -.routes into.-> HUNT
    CLI -.routes into.-> WORKFLOW
    CLI -.routes into.-> REPORT

How to read the map:

• Boxes are skills (auto-load by keyword) or skill clusters
• Solid arrows = standard engagement progression (scope → recon → hunt → validate → report)
• Dotted arrows = layered concerns (red-team mindset overlays the hunt phase; the CLI/slash layer routes into every phase)
• Numbers in parens = how many skills are in that group

If you're new and want to see what attacks the bundle teaches: focus on the Hunt (web) and Platform Attack (enterprise perimeter) groups. If you're already a hunter and want to know what's new vs your own workflow: look at Red Team Tradecraft and Validation & Discipline — those are the operator-discipline layer that most checklists skip.

Engagement Flow

Every engagement follows the same 6-phase loop. Skills auto-load at each phase. The Validate gate has 4 possible outcomes — only PASS