Bounty Operator Kit

A local command center for AI-assisted bug bounty hunting.

Turn scope, tools, scanner output, PoCs, duplicate checks, and report cleanup into a repeatable workflow an AI agent can actually follow.

---

Why this exists

AI can help with bounty hunting, but it needs guardrails. Without them it tends to chase noisy scanner output, miss scope, overstate impact, forget duplicate checks, or write reports that look sloppy.

This kit gives the agent a working process:

• pin the scope and current commit
• map the attack surface
• turn tool output into review queues
• keep a ledger of checked paths and killed leads
• demand runnable PoCs before report writing
• check audits, docs, PRs, issues, web results, and prior art
• clean the final text before anything leaves your machine

It is not a magic scanner. It is the operating layer around your tools.

Quick start

git clone https://github.com/krutftw/bounty-operator-kit.git
cd bounty-operator-kit
python -m pip install .
bounty-kit --help

Create a full AI agent pack for a target:

bounty-kit agent-pack ./agent-pack.md \
  --target "Example Protocol" \
  --program "Example bounty"

Give that file to your AI agent together with the public scope, known issues, current commit, and any selected scanner output.

The workflow

scope -> commit -> tools -> triage -> PoC -> prior art -> report -> sanitize

Step	Command	Output
Write agent rules	bounty-kit agent-pack	A complete operating pack for an AI session
Create a scoped task	bounty-kit agent-brief	A short work order for one target or surface
Track the hunt	bounty-kit init-ledger	A ledger for reviewed files, killed leads, and open questions
Triage Slither	bounty-kit slither-focus	A smaller Markdown queue from Slither JSON
Check prior art	bounty-kit prior-art	A duplicate and known-issue checklist
Review selected files	bounty-kit ai-review	API-backed review using only files you name
Check before sharing	bounty-kit sanitize	Fails on secrets, private URLs, browser paths, and unsafe files

Agent pack

The agent pack is the main feature.

bounty-kit agent-pack ./agent-pack.md \
  --target "Example Protocol" \
  --program "Example Contest" \
  --tool git \
  --tool rg \
  --tool Foundry \
  --tool Slither \
  --tool Aderyn \
  --tool "Pashov skills" \
  --tool Flounder

It tells the agent:

• what must be verified before a lead becomes a finding
• how to use scanners without trusting them blindly
• how to prove impact with a clean PoC
• how to check for known issues and duplicates
• what not to put in a report

See docs/agent-pack.md.

Prompt library

The prompts/ folder contains smaller review passes:

• bug-bounty-agent.md
• duplicate-risk-checker.md
• poc-reviewer.md
• report-editor.md
• tool-output-triager.md

Use them as separate checks. A single agent can miss its own mistakes.

Bring your own AI API key

ai-review is the only command that can call an AI API. It sends only the files you pass on the command line.

export BOUNTY_KIT_AI_API_KEY="..."
bounty-kit ai-review ./agent-pack.md ./ledger.md --prompt ./prompts/poc-reviewer.md

PowerShell:

$env:BOUNTY_KIT_AI_API_KEY = "..."
bounty-kit ai-review .\agent-pack.md .\ledger.md --prompt .\prompts\poc-reviewer.md

OpenAI-compatible endpoint:

bounty-kit ai-review ./ledger.md \
  --base-url "https://api.example.com/v1" \
  --model "model-name"

Safety model

This repo is built for local work. It does not include:

• private reports
• target-specific PoCs
• scraped platform pages
• browser profiles
• cookies
• wallet files
• API keys or RPC keys
• copied third-party tools

Before publishing or sending a workspace:

bounty-kit sanitize .

The sanitizer checks common secret formats, private report URLs, browser profile paths, and files that should not land in a public repo.

Recommended tools

This kit works best around a normal security toolbox:

• git, rg, jq
• Foundry
• Slither
• Aderyn
• semgrep
• Echidna or Medusa
• public audit skill packs and references

Optional public projects worth installing from their own upstream repos:

• Pashov skills
• Pashov ai-web3-security
• ZeroSkills
• Flounder
• Semia

Nothing from those projects is bundled here. Keep their licenses and attribution intact.

See docs/recommended-tools.md.

Example session

bounty-kit agent-pack ./agent-pack.md --target "Vault" --program "Immunefi"
bounty-kit init-ledger ./ledger.md --target "Vault" --program "Immunefi"

slither . --json slither.json
bounty-kit slither-focus slither.json --markdown > slither-focus.md

bounty-kit prior-art ./finding-summary.md \
  --target "Vault" \
  --repo "https://github.com/example/protocol"

bounty-kit sanitize .

Docs

• AI agent flow
• Agent pack
• Workflow
• Recommended tools

License

MIT. Use it, change it, and keep the license notice.