Audit candidate: elementalsouls/Claude-BugHunter

[xiaolai]

source: 'alan@repo-scout (claudepot-office relay)'
repo: 'elementalsouls/Claude-BugHunter'
discovered_at: '2026-05-24T13:11:57.370982+00:00'
stars_24h: 47
stars_7d_avg: 4.43
forks_24h: 5
releases_24h: 0
unique_actors: 83
last_event_at: '2026-05-24T11:46:55+00:00'
artifact_count: 65
stars_total: 542
description: 'A Claude Code skill bundle for bug hunting and external red-team work - 51 skills, 15 slash commands, 574+ disclosed-report patterns curated across 24 vulnerability classes, plus enterprise identity +'

Repo: https://github.com/elementalsouls/Claude-BugHunter

Velocity-signal candidate from BigQuery githubarchive.day (WatchEvent / ForkEvent / ReleaseEvent in the last 24h, vs 7-day baseline). Filtered through the Claude-Code keyword regex, GH artifact probe (65 artifacts), and NLPM-registry dedupe.

Relay script: claudepot-office/scripts/nlpm_relay.py.
Design note: claudepot-office/dev-docs/2026-05-19-nlpm-relay-design.md.

[github-actions]

Vocab drift advisory: 8 candidate(s). Report: auditor/audits/elementalsouls-Claude-BugHunter.vocab-drift.md on the auditor branch.

This is advisory only — vocabulary discipline is project-specific and per-repo. No PR will be filed for these findings.

[github-actions]

Audit Complete: elementalsouls/Claude-BugHunter

NL Score: 79/100 | Security: CLEAR | Artifacts: 65 | Strategy: progressive

Audit — elementalsouls/Claude-BugHunter

Repo: elementalsouls/Claude-BugHunter
Audited: 2026-05-24
Auditor: nlpm auditor pipeline
NL Score: 79/100
Security: CLEAR
Artifacts audited: 65 (14 commands, 51 skills)

---

NL Score Summary

File	Score
commands/remember.md	60/100
commands/validate.md	60/100
commands/intel.md	60/100
commands/token-scan.md	60/100
commands/recon.md	60/100
commands/web3-audit.md	60/100
commands/triage.md	60/100
commands/autopilot.md	60/100
commands/hunt.md	60/100
commands/report.md	60/100
commands/chain.md	60/100
commands/surface.md	65/100
commands/memory-gc.md	70/100
commands/pickup.md	70/100
skills/hunt-cloud-misconfig/SKILL.md	72/100
skills/hunt-llm-ai/SKILL.md	73/100
skills/bb-local-toolkit/SKILL.md	76/100
skills/hunt-mfa-bypass/SKILL.md	78/100
skills/bug-bounty/SKILL.md	80/100
skills/hunt-http-smuggling/SKILL.md	80/100
skills/web2-recon/SKILL.md	80/100
skills/hunt-dispatch/SKILL.md	80/100
skills/hunt-saml/SKILL.md	82/100
skills/vmware-vcenter-attack/SKILL.md	82/100
skills/okta-attack/SKILL.md	82/100
skills/offensive-osint/SKILL.md	82/100
skills/cloud-iam-deep/SKILL.md	83/100
skills/security-arsenal/SKILL.md	83/100
skills/apk-redteam-pipeline/SKILL.md	83/100
skills/evidence-hygiene/SKILL.md	83/100
skills/meme-coin-audit/SKILL.md	83/100
skills/enterprise-vpn-attack/SKILL.md	83/100
skills/hunt-graphql/SKILL.md	83/100
skills/web3-audit/SKILL.md	84/100
skills/hunt-sqli/SKILL.md	84/100

---

Full report: https://github.com/xiaolai/nlpm-for-claude/blob/main/auditor/audits/elementalsouls-Claude-BugHunter.md

No bugs found. Quality issues only, no PRs needed.

[xiaolai]

Contribution run complete for elementalsouls/Claude-BugHunter (first contact, 2 PRs opened):

1. PR #1 — fix: add missing name: field to all 14 command frontmatter blocks

   • All 14 command files were missing the required name: frontmatter field (only description: present). CONTRIBUTING.md explicitly requires name as the first frontmatter field.

2. PR #2 — fix: deduplicate hunt-race-condition, hunt-cache-poison, hunt-subdomain in dispatch WAPT list

   • Three skills appeared twice each in the hunt-dispatch WAPT taxonomy list due to copy-paste overlap across consecutive lines.

Both bugs independently verified before submission. No security issues (verdict: CLEAR). No summary issue opened on target repo.

[xiaolai]

Contribute run — elementalsouls/Claude-BugHunter

Two PRs opened after independent reproduction of each bug:

• PR Audit candidate: xiaolai/codex-toolkit-for-claude #3 — fix: add missing name: field to all 14 command frontmatters
  All 14 command files were missing the required name: frontmatter field. Verified with grep -l "^name:" commands/*.md returning nothing.

• PR Audit candidate: AgriciDaniel/claude-seo #4 — fix: deduplicate WAPT skill list in hunt-dispatch
  hunt-race-condition, hunt-cache-poison, and hunt-subdomain each appeared twice in both the full skill list and the WAPT taxonomy block. Verified with grep confirming duplicate lines.

Dropped: BUG-missing-frontmatter-allowed-tools — classified as quality (R05) in the sidecar, not a bug; skipped per contribute rules.

[xiaolai]

Contribute run — elementalsouls/Claude-BugHunter (no new PRs)

Both bugs from the audit are already covered by open PRs from prior runs:

• PR Audit candidate: xiaolai/codex-toolkit-for-claude #3 — fix: add missing name: field to all 14 command frontmatters — covers all 14 BUG-missing-frontmatter fingerprints
• PR Audit candidate: AgriciDaniel/claude-seo #4 — fix: deduplicate WAPT skill list in hunt-dispatch — covers BUG-duplicate-entries fingerprint

No new PRs opened this run to avoid duplicating open work.

[xiaolai]

PRs opened for elementalsouls/Claude-BugHunter:

• fix: add missing name: field to all 14 command frontmatters elementalsouls/Claude-BugHunter#3 — add missing name: field to all 14 command frontmatters (BUG-missing-frontmatter, 14 files)
• fix: deduplicate WAPT skill list in hunt-dispatch elementalsouls/Claude-BugHunter#4 — deduplicate hunt-race-condition, hunt-cache-poison, hunt-subdomain in hunt-dispatch WAPT taxonomy (BUG-duplicate-entries)

Both bugs independently reproduced before submission. No security fixes required (verdict: CLEAR). Quality issues dropped per policy (not mechanical breakage).

[xiaolai]

Contribute run: elementalsouls/Claude-BugHunter

All audit findings were already fixed by prior PRs from this fork that the maintainer merged:

• Audit candidate: xiaolai/loc-guardian-for-claude #1 fix/nlpm-missing-command-name-frontmatter — merged (fixed name: field in command frontmatter)
• Audit candidate: xiaolai/grill-for-claude #2 fix/nlpm-dispatch-duplicate-skill-entries — merged (fixed duplicate entries in hunt-dispatch)
• Audit candidate: xiaolai/codex-toolkit-for-claude #3 fix/nlpm-missing-frontmatter-name — merged (duplicate fix for same issue)
• Audit candidate: AgriciDaniel/claude-seo #4 fix/nlpm-dispatch-duplicate-entries — merged (duplicate fix for same issue)

No new PRs opened. Both bugs from the audit report (BUG-missing-frontmatter and BUG-duplicate-entries) are resolved in upstream main as of commit 162dbee.

[xiaolai]

Contribute pass — elementalsouls/Claude-BugHunter

No new PRs opened. All audit findings are already fixed:

• BUG-missing-frontmatter (14 command files, name: field absent) → fixed in PR #1 and #3, both merged.
• BUG-duplicate-entries (skills/hunt-dispatch/SKILL.md, three duplicated WAPT skills) → fixed in PR #2 and #4, both merged.

Verified current HEAD: all 14 commands now have name: frontmatter; hunt-dispatch WAPT list has no duplicate entries. No actionable findings remain.

[xiaolai]

PRs for elementalsouls/Claude-BugHunter — both already merged (2026-05-25):

• Audit candidate: xiaolai/codex-toolkit-for-claude #3 (MERGED): fix: add missing name: field to all 14 command frontmatters — fix: add missing name: field to all 14 command frontmatters elementalsouls/Claude-BugHunter#3
• Audit candidate: AgriciDaniel/claude-seo #4 (MERGED): fix: deduplicate WAPT skill list in hunt-dispatch — fix: deduplicate WAPT skill list in hunt-dispatch elementalsouls/Claude-BugHunter#4

Bugs fixed: BUG-missing-frontmatter (14 command files) + BUG-duplicate-entries (hunt-dispatch WAPT list). No open items remain.

[xiaolai]

PRs opened for elementalsouls/Claude-BugHunter:

• Audit candidate: ChrisWiles/claude-code-showcase #5 — fix: add missing name: field to all 14 command frontmatter blocks
  fix: add missing name: field to all 14 command frontmatter blocks elementalsouls/Claude-BugHunter#5

• Audit candidate: CloudAI-X/claude-workflow-v2 #6 — fix: remove duplicate skill entries in hunt-dispatch taxonomy
  fix: remove duplicate skill entries in hunt-dispatch taxonomy elementalsouls/Claude-BugHunter#6