Super Rouge Hunter Skills

Community-editable security skills for Claude Code's super-rouge-hunter plugin.

Overview

This repository provides a curated collection of security-focused skills designed for red teamers, bug bounty hunters, and security researchers. Each skill provides systematic methodologies, tool recommendations, and practical examples for security operations.

Structure

The skills are organized into focused categories:

🔍 Reconnaissance (skills/reconnaissance/)

Skills for information gathering and attack surface mapping:

• automated-subdomain-enum - Systematic subdomain discovery through passive and active techniques
• web-app-recon - Comprehensive web application attack surface mapping
• service-fingerprinting - Identifying services, versions, and technologies

🎯 Exploitation (skills/exploitation/)

Skills for developing and executing exploits:

• exploit-dev-workflow - Systematic exploit development from vulnerability to weaponization
• payload-generation - Creating and customizing payloads for various scenarios
• fuzzing-harness - Building effective fuzzing harnesses for vulnerability discovery

🔬 Analysis (skills/analysis/)

Skills for vulnerability research and code analysis:

• zero-day-hunting - Discovering novel vulnerabilities through systematic research
• static-vuln-analysis - Finding security flaws through code review
• binary-analysis - Reverse engineering and analyzing compiled binaries

🤖 Automation (skills/automation/)

Skills for automating security workflows:

• Coming soon: Automated recon pipelines, continuous security monitoring

📚 Documentation (skills/documentation/)

Skills for organizing and maintaining security knowledge:

• Coming soon: Building knowledge bases, organizing research findings

Skill Format

Each skill follows a consistent structure:

---
name: Skill Name
description: Brief description of what the skill does
when_to_use: Specific scenarios where this skill should be applied
version: 1.0.0
languages: Relevant programming languages
---

# Skill Name

## Overview
High-level explanation and core principles

## When to Use
Detailed guidance on when to apply this skill

## Methodology
Step-by-step methodology with phases or sections

## Tool Recommendations
Recommended tools and how to use them

## Common Pitfalls
Mistakes to avoid with solutions

## Legal and Ethical Considerations
Critical guidelines for responsible use

## Integration with Other Skills
How this skill relates to others

## References
Further reading and resources

Installation

This repository is designed to be used with Claude Code's super-rouge-hunter plugin. The plugin will automatically clone this repository to provide Claude with security-focused skills.

For manual usage:

git clone https://github.com/macaugh/super-rouge-hunter-skills.git
cd super-rouge-hunter-skills

Usage

When working with Claude Code, you can reference specific skills:

• "Use the automated-subdomain-enum skill to discover subdomains for target.com"
• "Apply the zero-day-hunting methodology to analyze this source code"
• "Follow the exploit-dev-workflow to create a proof of concept"

Claude will follow the systematic methodologies defined in each skill to complete security tasks effectively.

Contributing

We welcome contributions from the security community! Here's how you can help:

Adding New Skills

1. Fork this repository
2. Create a new skill directory: skills/[category]/[skill-name]/
3. Create SKILL.md following the standard format
4. Add practical examples and tool recommendations
5. Test the skill with real-world scenarios
6. Submit a pull request

Improving Existing Skills

• Add new techniques or tools
• Update outdated information
• Fix errors or improve clarity
• Add examples and case studies
• Share lessons learned from real engagements

Skill Guidelines

Skills should be:

• Systematic: Provide clear methodologies, not just tool lists
• Practical: Include working examples and commands
• Ethical: Emphasize legal and ethical considerations
• Current: Use modern tools and techniques
• Comprehensive: Cover both automated and manual approaches
• Educational: Explain the "why" behind techniques

Legal and Ethical Use

⚠️ CRITICAL WARNING ⚠️

All skills in this repository are provided for:

• Authorized security testing with written permission
• Educational purposes in controlled environments
• Legitimate bug bounty programs within defined scope
• Security research on systems you own or have permission to test

Unauthorized access to computer systems is illegal. Always:

1. ✅ Get explicit written authorization before testing
2. ✅ Understand and respect scope limitations
3. ✅ Follow responsible disclosure practices
4. ✅ Document all activities
5. ✅ Handle discovered vulnerabilities responsibly
6. ❌ Never use these skills for malicious purposes
7. ❌ Never test systems without permission
8. ❌ Never weaponize or publicly release exploits before coordination

Know your local laws (CFAA in US, Computer Misuse Act in UK, etc.) and the legal implications of security testing.

Skill Categories and Roadmap

Current Skills

• ✅ Reconnaissance (3 skills)
• ✅ Exploitation (2 skills)
• ✅ Analysis (2 skills)

Planned Additions

• 🔄 Automation skills (recon pipelines, CI/CD security)
• 🔄 Documentation skills (knowledge bases, reporting)
• 🔄 Additional exploitation skills (fuzzing, kernel exploitation)
• 🔄 Binary analysis and reverse engineering
• 🔄 Post-exploitation and persistence
• 🔄 Cloud security (AWS, Azure, GCP)
• 🔄 Container and Kubernetes security
• 🔄 API security testing
• 🔄 Wireless security assessment

Community

This is a community-driven project. We encourage:

• 💬 Discussion of techniques and improvements
• 🐛 Bug reports and corrections
• 💡 Suggestions for new skills
• 📖 Sharing real-world experiences
• 🎓 Educational use and learning

Resources

Learning Resources

• OWASP Testing Guide
• PortSwigger Web Security Academy
• HackTheBox and TryHackMe platforms
• Bug Bounty platforms (HackerOne, Bugcrowd)
• Security conference talks (DEF CON, Black Hat)

Tool Resources

• ProjectDiscovery tools (subfinder, httpx, nuclei)
• Metasploit Framework
• Burp Suite
• Ghidra and IDA Pro
• AFL++ and fuzzing tools

Community Resources

• Bug bounty disclosure reports
• Security research blogs
• Open source security tools
• CVE databases

License

This project is licensed under the MIT License - see the LICENSE file for details.

Acknowledgments

Inspired by obra/superpowers-skills - a similar skills repository for general development tasks.

Special thanks to the security community for sharing knowledge, techniques, and responsible disclosure practices that make everyone more secure.

Disclaimer

The skills and techniques described in this repository are provided for educational and authorized security testing purposes only. The authors and contributors are not responsible for any misuse or damage caused by the use of these skills. Users must ensure they have proper authorization before conducting any security testing activities.