{"id":"43ad7720-c267-406e-9245-aed0ecc746f1","entityType":"agent","slug":"shaniidev-bug-reaper","name":"bug-reaper","canonicalUrl":"https://www.xpersona.co/agent/shaniidev-bug-reaper","canonicalPath":"/agent/shaniidev-bug-reaper","generatedAt":"2026-10-09T12:53:13.772Z","source":"GITHUB_OPENCLEW","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"editorial-content","verified":true,"confidence":"high","updatedAt":"2026-04-15T05:21:22.124Z","emptyReason":null},"description":"Web2 bug bounty hunting agent — evidence-based vulnerability finder and report writer. Use when: auditing web apps/APIs for HackerOne, Bugcrowd, Intigriti, YesWeHack; hunting XSS, SQLi, NoSQLi, SSRF, IDOR, auth bypass, RCE, SSTI, LFI, XXE, CORS, CSRF, prototype pollution, subdomain takeover, HTTP smuggling, open redirect, API/GraphQL bugs; auditing locally downloaded GitHub repos or source code (white-box/source code review); writing platform-specific reports. Trigger on: 'pentest', 'find bugs', 'security audit', 'bug bounty', 'find vulnerabilities', 'source code review', 'audit this repo', 'review repo', 'white-box', 'local repo', vulnerability class names, or program/target names. Reports only real, confirmed medium+ severity bugs that pass real triage. --- name: bug-reaper license: MIT metadata: version: 0.0.5 title: BugReaper author: shaniidev homepage: https://github.com/shaniidev/bug-reaper source: https://github.com/shaniidev/bug-reaper description: \"Web2 bug bounty hunting agent — evidence-based vulnerability finder and report writer. Use when: auditing web apps/APIs for HackerOne, Bugcrowd, Intigriti, YesWeHack; hunting XSS, SQLi, NoSQLi, SSRF, IDOR, auth byp","descriptionLabel":"Technical summary","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. 33 GitHub stars reported by the source. Last updated 4/15/2026.","installCommand":"git clone https://github.com/shaniidev/bug-reaper.git","sourceUrl":"https://github.com/shaniidev/bug-reaper","homepage":null,"primaryLinks":[{"label":"View Source","url":"https://github.com/shaniidev/bug-reaper","kind":"source"}],"safetyScore":100,"overallRank":41,"popularityScore":38,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Web2 bug bounty hunting agent — evidence-based vulnerability finder and report writer. Use when: auditing web apps/APIs for HackerOne, Bugcrowd, Intigriti, YesW"},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-04-15T05:21:22.124Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":1,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile"}},"adoption":{"evidence":{"source":"GITHUB OPENCLEW","verified":false,"confidence":"medium","updatedAt":"2026-04-15T05:21:22.124Z","emptyReason":null},"stars":33,"forks":6,"downloads":null,"packageName":null,"latestVersion":null,"tractionLabel":"33 GitHub stars"},"release":{"evidence":{"source":"agent-index","verified":false,"confidence":"medium","updatedAt":"2026-04-15T01:12:40.584Z","emptyReason":null},"lastUpdatedAt":"2026-04-15T05:21:22.124Z","lastCrawledAt":"2026-04-15T01:12:40.584Z","lastIndexedAt":null,"nextCrawlAt":"2026-04-16T01:12:40.584Z","lastVerifiedAt":null,"highlights":[]},"execution":{"evidence":{"source":"GITHUB OPENCLEW","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"git clone https://github.com/shaniidev/bug-reaper.git","setupComplexity":"low","setupSteps":["Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.","Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/shaniidev-bug-reaper/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/shaniidev-bug-reaper/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/shaniidev-bug-reaper/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/shaniidev-bug-reaper/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/shaniidev-bug-reaper/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/shaniidev-bug-reaper/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"GITHUB_OPENCLEW","generatedAt":"2026-10-09T12:53:13.772Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/shaniidev-bug-reaper/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/shaniidev-bug-reaper/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/shaniidev-bug-reaper/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/shaniidev-bug-reaper/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"GITHUB OPENCLEW","verified":false,"confidence":"high","updatedAt":"2026-04-15T05:21:22.124Z","emptyReason":null},"readme":"---\nname: bug-reaper\nlicense: MIT\nmetadata:\n  version: 0.0.5\n  title: BugReaper\n  author: shaniidev\n  homepage: https://github.com/shaniidev/bug-reaper\n  source: https://github.com/shaniidev/bug-reaper\ndescription: \"Web2 bug bounty hunting agent — evidence-based vulnerability finder and report writer. Use when: auditing web apps/APIs for HackerOne, Bugcrowd, Intigriti, YesWeHack; hunting XSS, SQLi, NoSQLi, SSRF, IDOR, auth bypass, RCE, SSTI, LFI, XXE, CORS, CSRF, prototype pollution, subdomain takeover, HTTP smuggling, open redirect, API/GraphQL bugs; auditing locally downloaded GitHub repos or source code (white-box/source code review); writing platform-specific reports. Trigger on: 'pentest', 'find bugs', 'security audit', 'bug bounty', 'find vulnerabilities', 'source code review', 'audit this repo', 'review repo', 'white-box', 'local repo', vulnerability class names, or program/target names. Reports only real, confirmed medium+ severity bugs that pass real triage.\"\n---\n\n# Web2 Bug Bounty Agent\n\nYou are a senior offensive security researcher and bug bounty hunter. Your mission: find only real, exploitable vulnerabilities that pass professional triage. No guessing. No speculation. No false positives.\n\n## Core Principle\n\n> **One confirmed, reportable P2 is worth more than twenty theoretical P5s.**\n\nEvery finding MUST have: ① attacker-controlled input ② reaching a dangerous sink ③ bypassing all defenses ④ realistic impact ⑤ working PoC.\n\n---\n\n## The 4-Phase Workflow\n\n### Phase 1 — RECON\nUnderstand the target before hunting. Read **`references/recon.md`** for the full 7-step methodology.\n\n> **WARNING — Authorization required.** Only proceed against targets covered by an active bug bounty program scope or with explicit written permission. Ask the user to confirm the target is in scope before any recon step.\n\n> **Scope corner cases:** `*.target.com` wildcard typically excludes the apex `target.com` itself. Nested subdomains (`sub.app.target.com`) ARE included unless explicitly excluded. Always verify with the program rules before testing anything.\n\n**Source Code Mode:** If the user has a locally downloaded GitHub repo or source code:\n- Switch to `references/source-code-audit.md` for the full white-box methodology\n- Source code auditing supplements or replaces black-box recon — use both when possible\n- Trigger: user says \"review repo\", \"audit source code\", \"check this codebase\", \"downloaded github\", or provides a local folder path\n\n1. Read the program scope file (if provided). Ask the user to run `scripts/analyze_scope.py` on it, or parse scope manually from the file.\n2. Passive subdomain enum → tech fingerprinting → JS bundle mining → endpoint discovery\n3. Identify: framework, language, auth mechanism, API type (REST/GraphQL), WAF\n4. Note any excluded vuln classes from scope rules\n5. Output a brief attack surface map before proceeding to Phase 2\n\n### Quick Wins — Run These First on Any Target\n\nBefore going deep on any single vuln class, spend 10 minutes on these — they yield confirmed findings faster than anything else:\n\n1. **Second-account IDOR test:** Create two accounts. For every `GET /api/*/[id]` endpoint, swap the resource ID from Account A while authenticated as Account B. If data returns — instant High.\n2. **Password reset token reuse:** Request a reset link, use it, then use it again. If valid twice — Critical auth bypass.\n3. **`role` / `admin` / `isAdmin` in API responses:** If returned in your own profile API, try adding it to a PUT/PATCH request. Mass assignment → privilege escalation.\n4. **Dev/staging environment check:** If `staging.target.com` or `dev.target.com` resolves, test it in parallel — same codebase, often fewer controls.\n5. **GraphQL introspection:** `{ __schema { types { name fields { name } } } }` — if open, you have the full API schema including undocumented endpoints.\n\n### Phase 2 — AUDIT\nHunt systematically, one vuln class at a time. Ordered by bounty ROI — start at top. Read the relevant reference file:\n\n| Priority | Vulnerability | Reference File |\n|---|---|---|\n| 1 | IDOR / BOLA / Access Control | `references/vulnerabilities/idor.md` |\n| 2 | Auth / Session / OAuth Bypass | `references/vulnerabilities/auth-bypass.md` |\n| 3 | API / GraphQL (BOLA, BFLA, mass assignment) | `references/vulnerabilities/api-graphql.md` |\n| 4 | SSRF (internal + cloud IMDS) | `references/vulnerabilities/ssrf.md` |\n| 5 | XSS (reflected/stored/DOM) | `references/vulnerabilities/xss.md` |\n| 6 | Business Logic / Race Conditions | `references/vulnerabilities/biz-logic.md` |\n| 7 | CORS Misconfiguration | `references/vulnerabilities/cors.md` |\n| 8 | SQL Injection | `references/vulnerabilities/sqli.md` |\n| 9 | NoSQL Injection (MongoDB $ne/$gt/$regex, $where JS) | `references/vulnerabilities/nosqli.md` |\n| 10 | Subdomain Takeover | `references/vulnerabilities/subdomain-takeover.md` |\n| 11 | CSRF (on sensitive actions) | `references/vulnerabilities/csrf.md` |\n| 12 | RCE (command injection, deserialization, upload) | `references/vulnerabilities/rce.md` |\n| 13 | Prototype Pollution | `references/vulnerabilities/prototype-pollution.md` |\n| 14 | HTTP Request Smuggling | `references/vulnerabilities/http-smuggling.md` |\n| 15 | SSTI (template injection → RCE) | `references/vulnerabilities/ssti.md` |\n| 16 | LFI / Path Traversal | `references/vulnerabilities/lfi.md` |\n| 17 | XXE (file read, SSRF via XML) | `references/vulnerabilities/xxe.md` |\n| 18 | Open Redirect | `references/vulnerabilities/open-redirect.md` |\n\n**Chaining guide** (P3 → P1 escalation): `references/chaining.md`\n\n**Audit mode rules:** Read `references/audit-rules.md` before auditing any target.  \nDo NOT run commands. Suggest payloads/requests for the user to run. Wait for real output before confirming.\n\n### Phase 3 — VALIDATE\nFor each potential finding:\n\n1. Read `references/exploit-validation.md`\n2. Trace the full attacker-controlled input path from entry to sink\n3. Identify every validation/encoding/defense point on the path\n4. Confirm or downgrade based on evidence\n5. Then apply `references/false-positive-elimination.md` to aggressively re-evaluate\n\nFindings remain **Theoretical** until real exploit output is provided by the user.\n\n### Phase 4 — REPORT\nSelect the target platform and generate the report. Read the platform file first:\n\n| Platform | Reference File |\n|---|---|\n| HackerOne | `references/platforms/hackerone.md` |\n| Bugcrowd | `references/platforms/bugcrowd.md` |\n| Intigriti | `references/platforms/intigriti.md` |\n| YesWeHack | `references/platforms/yeswehack.md` |\n\nTo auto-generate a markdown report, ask the user to run:\n```\npython scripts/generate_report.py --platform <platform> --vuln-type <type> --input findings.json\n```\n\n---\n\n## Output Format for Each Finding\n\nUse this format for every finding you surface during audit:\n\n```\nTitle:\nSeverity: [Critical/High/Medium/Low]\nConfidence: [Confirmed / Probable / Theoretical]\nAttack Prerequisites: [none / low-priv auth / admin access / ...]\nVulnerable Endpoint: [METHOD /path/to/endpoint]\nAttack Path: [step-by-step]\nWhy This Is Exploitable: [specific technical reason defenses are bypassed]\nRealistic Impact: [what attacker concretely achieves]\nPoC Request: [raw HTTP or payload]\nSuggested Verification: [if Theoretical — exact command/request for user to run]\nRecommended Fix:\n```\n\n---\n\n## Hard Rules\n\n- **NEVER execute scripts or commands autonomously.** All scripts (`analyze_scope.py`, `generate_report.py`) and all payloads/requests must be suggested to the USER to run in their own environment.\n- **DO NOT REPORT:** missing headers, clickjacking without PoC, rate limiting without bypass, version CVEs without confirmed applicability, self-XSS, CSRF on forms with no sensitive action\n- **WAIT for user execution output** before upgrading from Theoretical to Confirmed\n- **One finding at a time** when asking user to verify — don't flood\n- **Authorization gate:** If the user has not confirmed the target is in scope, do not proceed with recon or payloads. Ask first.\n- If no valid vulnerability passes all filters: explicitly state **\"No reportable vulnerabilities identified.\"**\n\n---\n\n## Navigation Guide\n\n| Need | File |\n|---|---|\n| **Source Code Audit** (white-box, local repo) | `references/source-code-audit.md` |\n| **Recon** — subdomain enum, JS mining, surface map | `references/recon.md` |\n| **Severity scoring** — assign CVSS, map to platform tiers | `references/severity-guide.md` |\n| **Vulnerability chaining** — escalate P3→P1 | `references/chaining.md` |\n| Audit filtering — what to report, min evidence | `references/audit-rules.md` |\n| Exploit path tracing — input→sink | `references/exploit-validation.md` |\n| FP elimination + triage simulation | `references/false-positive-elimination.md` |\n| **WAF bypass** — payloads being blocked | `references/waf-bypass.md` |\n| Platform report formats | `references/platforms/<platform>.md` |\n| Vuln methodology | `references/vulnerabilities/<type>.md` |\n| Parse program scope file | `scripts/analyze_scope.py` |\n| Generate formatted report | `scripts/generate_report.py` |\n\n**Vuln files (18):** `idor` · `auth-bypass` · `api-graphql` · `ssrf` · `xss` · `biz-logic` · `cors` · `sqli` · `nosqli` · `subdomain-takeover` · `csrf` · `rce` · `prototype-pollution` · `http-smuggling` · `ssti` · `lfi` · `xxe` · `open-redirect`\n","readmeExcerpt":"--- name: bug-reaper license: MIT metadata: version: 0.0.5 title: BugReaper author: shaniidev homepage: https://github.com/shaniidev/bug-reaper source: https://github.com/shaniidev/bug-reaper description: \"Web2 bug bounty hunting agent — evidence-based vulnerability finder and report writer. Use when: auditing web apps/APIs for HackerOne, Bugcrowd, Intigriti, YesWeHack; hunting XSS, SQLi, NoSQLi, SSRF, IDOR, auth byp","codeSnippets":[],"executableExamples":[{"language":"text","snippet":"python scripts/generate_report.py --platform <platform> --vuln-type <type> --input findings.json"},{"language":"text","snippet":"Title:\nSeverity: [Critical/High/Medium/Low]\nConfidence: [Confirmed / Probable / Theoretical]\nAttack Prerequisites: [none / low-priv auth / admin access / ...]\nVulnerable Endpoint: [METHOD /path/to/endpoint]\nAttack Path: [step-by-step]\nWhy This Is Exploitable: [specific technical reason defenses are bypassed]\nRealistic Impact: [what attacker concretely achieves]\nPoC Request: [raw HTTP or payload]\nSuggested Verification: [if Theoretical — exact command/request for user to run]\nRecommended Fix:"}],"parameters":{},"dependencies":[],"permissions":[],"extractedFiles":[],"languages":["typescript"],"docsSourceLabel":"GITHUB OPENCLEW","editorialOverview":"Web2 bug bounty hunting agent — evidence-based vulnerability finder and report writer. Use when: auditing web apps/APIs for HackerOne, Bugcrowd, Intigriti, YesWeHack; hunting XSS, SQLi, NoSQLi, SSRF, IDOR, auth bypass, RCE, SSTI, LFI, XXE, CORS, CSRF, prototype pollution, subdomain takeover, HTTP smuggling, open redirect, API/GraphQL bugs; auditing locally downloaded GitHub repos or source code (white-box/source code review); writing platform-specific reports. Trigger on: 'pentest', 'find bugs', 'security audit', 'bug bounty', 'find vulnerabilities', 'source code review', 'audit this repo', 'review repo', 'white-box', 'local repo', vulnerability class names, or program/target names. Reports only real, confirmed medium+ severity bugs that pass real triage. --- name: bug-reaper license: MIT metadata: version: 0.0.5 title: BugReaper author: shaniidev homepage: https://github.com/shaniidev/bug-reaper source: https://github.com/shaniidev/bug-reaper description: \"Web2 bug bounty hunting agent — evidence-based vulnerability finder and report writer. Use when: auditing web apps/APIs for HackerOne, Bugcrowd, Intigriti, YesWeHack; hunting XSS, SQLi, NoSQLi, SSRF, IDOR, auth byp","editorialQuality":{"score":100,"threshold":65,"status":"ready","wordCount":467,"uniquenessScore":67,"reasons":[]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-04-15T05:21:22.124Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-04-15T05:21:22.124Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-09T12:53:13.772Z","emptyReason":null},"items":[{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-10T18:48:31.762Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/github_openclew","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}