Commands, context,
and workflows.
The command surface is small. Context files, workflow definitions, safety tiers, and evidence paths make each run inspectable.
Quick Start
# 1: Install (30 seconds) curl -fsSL https://raw.githubusercontent.com/Mr-Neutr0n/bounty-harness/main/install.sh | sh -s -- # 2: Initialize context for a target bb-init example.com --program example --scope-file scope.txt # 3: Run recon bb-run recon passive-subdomains bb-run recon live-discovery bb-run recon js-recon # 4: Or go autonomous bb-hunt https://example.com --time-budget 2h --scope-file scope.txt
Core Commands
| Command | What it does |
|---|---|
bb-init <target> | Creates .bb/context.env, the RunContext every workflow reads |
bb-validate | Checks context + scope file + tool registry |
bb-run <skill> <workflow> | Runs one workflow from .claude/skills/<skill>/skill.yaml |
bb-run list | Lists all 46 skills |
bb-run <skill> list | Lists workflows for one skill |
bb-hunt <url> | Autonomous: recon → plan → execute → report |
bb-tools doctor | Health check for external tools |
bb-tools install --profile recon | Install a tool profile |
Autonomous Campaigns
bb-hunt bootstraps its own context and runs unattended:
# Passive: safe for any target bb-hunt https://target.com --time-budget 2h # Authorized intrusive bb-hunt https://target.com --scope-file scope.txt --max-tier intrusive --time-budget 3h # Monitor progress bb-run campaign status
Without a scope file, intrusive is auto-capped to
active-safe. The harness enforces this. You cannot accidentally go intrusive.Skill Structure
Every skill at .claude/skills/<skill>/ follows the same layout:
.claude/skills/recon/ ├── SKILL.md : human facing router ├── skill.yaml : executable workflow registry ├── scripts/ : command implementations ├── runbooks/ : triage and manual guidance └── payloads/ : static payloads and fixtures
Prefer bb-run <skill> <workflow> after context init. Need to run manually? Copy the command from skill.yaml.
Safety Tiers
| Tier | Meaning |
|---|---|
| passive | Read-only discovery or local analysis |
| active-safe | Interacts with target but stays read-only |
| intrusive | Payloads, fuzzing, WAF-triggering |
| destructive-manual | Data modification. Explicit human approval required |
RunContext Variables
| Variable | Meaning |
|---|---|
TARGET | Primary target domain |
OUTDIR | Output directory for current run |
SCOPE_FILE | Authorization / scope file |
RATE_LIMIT | Requests per second |
CONCURRENCY | Concurrent workers |
AUTH_HEADER | Auth header for authenticated workflows |
Validation
make test # YAML parse + Python compile (all 46 skills) python3 tools/validate_skills.py # quality scores python3 tools/validate_skills.py audit-release # release gate