MCP App StoreMCP App Store
from bountyforge109
Orchestrates parallelized bug-bounty audits across smart contracts and web/APIs, producing deduplicated, gate-evaluated, platform-ready vulnerability reports fo
BountyForge is an orchestration skill that runs multi-mode bug bounty audits: discovering in-scope code, building agent bundles, spawning parallel auditing agents, deduplicating findings, running gate evaluations, computing CVSS, and formatting platform-specific submission-ready reports. It provides strict canonical report format rules and automated pipelines for triage, PoC generation, and confidence scoring.
Invoke when performing security research or automated/manual audits on smart contracts (Solidity, Move, Solana), web/API endpoints, or when you need a submission-ready HackerOne/Bugcrowd/Immunefi report. Also use in report-only mode to normalize and gate-evaluate existing finding lists.
Designed for multi-agent orchestrators and security analysis agents that can read repo files, run Bash tooling, and produce structured reports (Claude Code, Codex-like assistants, or custom orchestrators).
BountyForge is a comprehensive bug bounty orchestration skill covering smart contract audits, web/API security, CI/CD pipeline attacks, and report generation. The SKILL.md is ~49KB of detailed, well-structured content with practical checklists, bypass tables, PoC templates, and platform-specific report formatting. No bundled scripts. The auto-update mechanism checks a remote VERSION file and instructs git pull without user confirmation — a moderate security concern. The skill is monolithic with no script/references separation, and relies on external tools (nuclei, subfinder, katana) not declared as dependencies.
Notable security concern: the auto-update mechanism at the top instructs the agent to run 'git pull upstream main' without explicit user confirmation. While the curl only fetches a VERSION file, the subsequent git pull could introduce untrusted code. The skill content itself is appropriate for its stated purpose (bug bounty hunting) and does not instruct malicious behavior. Architecture is the weakest area — monolithic file with no scripts or bundled references despite referencing them extensively.
Bounty Hunter — Atlas
Persona skill: 'Atlas' — a profit-focused developer persona for discovering, evaluating and executing paid bounties or freelance tasks with ROI-aware workflows.
Monad Development
Practical developer skill for deploying and verifying smart contracts, configuring Foundry projects, and integrating frontends (viem/wagmi) on the Monad blockch
Reverse Engineer
Provides step-by-step guidance and best practices for binary reverse engineering: static analysis, dynamic tracing, disassembly, and documentation workflows for
Sandbox0 Integration
Guidance and templates for integrating Sandbox0 sandboxing into AI agents — CLI/SDK patterns, templates, volumes, network policy, and deployment choices.
OpenTestAI
Automated, high-confidence AI testing: bug detection, persona feedback, and prioritized test-case generation using many specialized tester profiles.
CTF Write-up Generator
Generate a concise, reproducible submission-style CTF writeup with a one-path solution script, metadata, and a short checklist for fast verification.
Minimal Run & Audit (repro reporting)
Execute a README-first smoke test and produce standardized reproducibility outputs (`repro_outputs/`) and PATCHES.md — trusted reporting for repo reproduction r
Skill Issue — Skill Auditor
Scan and audit installed agent skills to produce a health report covering inventory, usage, dependency checks, version status, and actionable recommendations.