feat(skills): add bug-chaining, johnwick, jsmax, pii-hunter, omni-kil…

.claude-plugin/plugin.json

@@ -0,0 +1,29 @@
+{
+  "name": "agentic-bug-hunter",
+  "description": "AI-powered bug bounty toolkit — recon, vulnerability hunting, validation gates, and submission-ready reports for HackerOne, Bugcrowd, Intigriti, and Immunefi.",
+  "version": "6.0.1",
+  "author": {
+    "name": "AwareXone",
+    "url": "https://awarexone.com"
+  },
+  "homepage": "https://github.com/Awarexone/Agentic-Bug-Hunter",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Awarexone/Agentic-Bug-Hunter.git"
+  },
+  "license": "MIT",
+  "keywords": [
+    "bug-bounty",
+    "security",
+    "recon",
+    "vulnerability-hunting",
+    "pentest",
+    "hackerone",
+    "bugcrowd",
+    "immunefi"
+  ],
+  "commands": "./commands",
+  "agents": "./bughunter/agents",
+  "skills": "./skills",
+  "hooks": "./hooks/hooks.json"
+}

.claude/settings.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "hooks": {
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "[ -f tools/memory_gc.py ] && python3 -m tools.memory_gc --rotate >/dev/null 2>&1 || true",
+            "timeout": 30,
+            "async": true
+          }
+        ]
+      }
+    ]
+  }
+}

.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,31 @@
+# Code of Conduct
+
+## Our Pledge
+
+We are a community of security researchers, bug bounty hunters, and developers. We pledge to make participation welcoming and harassment-free for everyone, regardless of experience level, background, or identity.
+
+## Our Standards
+
+**Expected:**
+- Respectful, constructive communication
+- Sharing knowledge and techniques that help others improve
+- Accepting feedback gracefully and giving it kindly
+- Crediting others for their work and findings
+
+**Not acceptable:**
+- Harassment, personal attacks, or discriminatory language
+- Sharing others' private information without consent
+- Using this toolkit or community to conduct unauthorized testing
+- Claiming others' bug bounty reports as your own
+
+## Scope
+
+This Code of Conduct applies in all project spaces — GitHub issues, PRs, discussions, and any community channels representing this project.
+
+## Enforcement
+
+Violations can be reported to [shuvon@awarexone.com](mailto:shuvon@awarexone.com) or [hello@awarexone.com](mailto:hello@awarexone.com). All reports are reviewed confidentially. Maintainers may remove, edit, or reject contributions that violate this Code of Conduct.
+
+---
+
+This project follows a simplified version of the [Contributor Covenant v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).

.github/CONTRIBUTING.md

@@ -0,0 +1,61 @@
+# Contributing
+
+Bug hunters welcome. Every improvement here makes real hunts more effective.
+
+## What We Most Need
+
+| Contribution | Why It Matters |
+|:---|:---|
+| New scanner modules or detection techniques | Increases surface coverage |
+| Payload additions to `skills/security-arsenal/SKILL.md` | Better bypass coverage |
+| Methodology improvements backed by paid reports | Proven techniques only |
+| Platform support (YesWeHack · Synack · HackenProof) | Wider program coverage |
+| False positive fixes with regression tests | Community's top complaint |
+
+## Before You Start
+
+1. **Check open issues** — your idea may already be in progress
+2. **One feature per PR** — keeps review fast and clean
+3. **Test your changes** — run `pytest tests/` before opening the PR
+4. **No theoretical bugs** — if it's a scanner addition, it must have a real PoC or real-world precedent
+
+## Workflow
+
+```bash
+# 1. Fork and clone
+git clone https://github.com/YOUR_USERNAME/Agentic-Bug-Hunter.git
+cd Agentic-Bug-Hunter
+
+# 2. Create a branch
+git checkout -b feat/your-contribution
+
+# 3. Make your changes, run tests
+pytest tests/
+
+# 4. Commit
+git commit -m "feat: short description of what and why"
+
+# 5. Push and open PR
+git push origin feat/your-contribution
+```
+
+## Commit Message Format
+
+```
+feat:  new capability
+fix:   bug fix
+docs:  documentation only
+test:  adding or fixing tests
+chore: maintenance (deps, CI, cleanup)
+```
+
+## PR Checklist
+
+- [ ] Tests pass (`pytest tests/`)
+- [ ] No hardcoded targets, API keys, or real domain names in code
+- [ ] Scanner additions use `[CONFIRMED]` / `[POSSIBLE]` / `[INFORMATIONAL]` confidence states
+- [ ] Methodology changes are backed by a real finding or public write-up
+
+## Questions?
+
+Open a [GitHub Discussion](https://github.com/Awarexone/Agentic-Bug-Hunter/discussions) or reach out at [hello@awarexone.com](mailto:hello@awarexone.com).

.github/FUNDING.yml

@@ -0,0 +1,8 @@
+# Sponsor BugHunter — helps fund new features and keeps the free standalone mode running.
+# Powered by AwareXone.com — https://awarexone.com
+# Native GitHub Sponsors button → https://github.com/sponsors/awarexone
+
+github: [awarexone]
+custom:
+Bitcoin (BTC)	1GXwGqmLcnbZWgVNskUAZyw2cmqenkUFNY
+Solana (SOL)	4ArkPu1E7tkrt3d5X84grWzF1xjuLpScgGEy12Bp2cmE

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,40 @@
+---
+name: Bug Report
+about: Something in the toolkit isn't working correctly
+title: "[BUG] "
+labels: bug
+assignees: shuvonsec
+---
+
+## What happened?
+
+<!-- A clear description of the bug -->
+
+## Steps to Reproduce
+
+```bash
+# Paste the exact command(s) that triggered the bug
+```
+
+## Expected Behavior
+
+<!-- What should have happened? -->
+
+## Actual Behavior
+
+<!-- What did happen? Paste the error output here -->
+
+```
+error output here
+```
+
+## Environment
+
+- **OS:** (macOS / Ubuntu / Kali / other)
+- **Python version:** (`python3 --version`)
+- **Tool version / commit:** (`git rev-parse HEAD`)
+- **External tools installed:** (subfinder / httpx / nuclei / etc.)
+
+## Additional Context
+
+<!-- Any other details — target type, program platform, etc. (no real target names) -->

.github/ISSUE_TEMPLATE/false_positive.md

@@ -0,0 +1,27 @@
+---
+name: False Positive Report
+about: The scanner flagged something that came back N/A or is not a real vulnerability
+title: "[FP] "
+labels: false-positive
+assignees: shuvonsec
+---
+
+## What was flagged?
+
+<!-- Scanner output line — paste the [CONFIRMED] / [POSSIBLE] finding -->
+
+```
+[POSSIBLE] XSS found at ...
+```
+
+## Why is it a false positive?
+
+<!-- What made this come back N/A? CSP blocked it? Own data only? DNS-only SSRF? -->
+
+## Program / Context
+
+<!-- Bug bounty platform (H1, Bugcrowd, etc.) — no real target names needed -->
+
+## Kill Signal
+
+<!-- What observable signal should we add to the kill-signal table to prevent this in future? -->

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,27 @@
+---
+name: Feature Request
+about: Suggest a new capability or improvement
+title: "[FEAT] "
+labels: enhancement
+assignees: shuvonsec
+---
+
+## What do you want?
+
+<!-- One-sentence summary of the feature -->
+
+## Why does this matter?
+
+<!-- What does it enable? What bug class does it catch? Is it backed by a real finding? -->
+
+## Proposed Approach
+
+<!-- How would you implement it? Which file(s) would change? -->
+
+## Alternatives Considered
+
+<!-- What else did you consider? Why is your approach better? -->
+
+## References
+
+<!-- Writeups, CVEs, HackerOne disclosed reports, or other evidence this technique works -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,29 @@
+## Summary
+
+<!-- What does this PR do? One to three bullet points. -->
+
+-
+-
+
+## Type
+
+- [ ] Bug fix
+- [ ] New feature / scanner module
+- [ ] Methodology improvement
+- [ ] Documentation
+- [ ] False positive reduction
+
+## Test Plan
+
+- [ ] `pytest tests/` passes locally
+- [ ] No hardcoded targets, API keys, or real domain names
+- [ ] Scanner additions use `[CONFIRMED]` / `[POSSIBLE]` / `[INFORMATIONAL]` confidence states
+- [ ] New functionality has at least one regression test
+
+## Related Issue
+
+Closes #
+
+## Evidence (for methodology changes)
+
+<!-- Link to a write-up, CVE, or disclosed report that backs this technique -->

.github/SECURITY.md

@@ -0,0 +1,42 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|:---|:---|
+| v5.x (latest) | Yes |
+| v4.x | Critical fixes only |
+| < v4.0 | No |
+
+## Reporting a Vulnerability
+
+If you find a security issue in this toolkit itself (not a bug bounty finding on a third-party target), please **do not open a public GitHub issue**.
+
+**Email:** [shuvon@awarexone.com](mailto:shuvon@awarexone.com)  
+**CC / general:** [hello@awarexone.com](mailto:hello@awarexone.com)  
+**Subject line:** `[SECURITY] Brief description`
+
+Include:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Your suggested fix (optional)
+
+You will receive a response within **72 hours**. Critical issues are patched and released within 7 days.
+
+## Scope
+
+This policy covers vulnerabilities in:
+- `tools/` — Python and shell scanner scripts
+- `memory/` — hunt memory system
+- `install.sh` / `install_tools.sh` — installer scripts
+- `demo/` — local demo server
+
+**Out of scope:** Third-party programs you test using this toolkit. Those belong in their respective bug bounty programs.
+
+## Responsible Disclosure
+
+We follow coordinated disclosure. We will:
+- Acknowledge your report within 72 hours
+- Keep you updated on the fix timeline
+- Credit you in the release notes (unless you prefer anonymity)

.github/workflows/tests.yml

@@ -0,0 +1,40 @@
+name: tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pytest:
+    name: pytest (py${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+
+      - name: Run test suite
+        run: pytest -q