Skip to content

feat: Autonomous Bounty-Hunting Agent (Closes #861)#1235

Open
lloyd-c137 wants to merge 1 commit into
SolFoundry:mainfrom
lloyd-c137:feat/autonomous-bounty-hunting-agent
Open

feat: Autonomous Bounty-Hunting Agent (Closes #861)#1235
lloyd-c137 wants to merge 1 commit into
SolFoundry:mainfrom
lloyd-c137:feat/autonomous-bounty-hunting-agent

Conversation

@lloyd-c137
Copy link
Copy Markdown

Autonomous Bounty-Hunting Agent

A fully autonomous multi-agent system that discovers open-source bounties, audits repositories for security vulnerabilities, generates AI-powered fixes, and submits PRs.

Closes #861

How It Works

Phase 1: Discovery        →  Scans Algora, GitHub issues, Security Advisories
Phase 2: Security Audit   →  Semgrep (1000+ rules) + pattern matching
Phase 3: AI Fix Generation →  GLM-4.1V with security-focused prompting
Phase 4: PR Report         →  Structured markdown with findings and fixes

Multi-LLM Architecture

Model Role
DeepSeek V4 Flash Planning & orchestration
GLM-4.1V-9B-Thinking Vulnerability analysis & fix generation
Semgrep (p/security-audit, p/owasp-top-ten) Static analysis engine

Proven Results

This agent was tested on SolFoundry itself — our first PR (#1232) found 5 critical and 10 high-severity vulnerabilities and is currently under AI review.

Quick Start

node agents/bounty-hunter/bounty-hunter.js discover
node agents/bounty-hunter/bounty-hunter.js scan <org/repo>
node agents/bounty-hunter/bounty-hunter.js pipeline

Wallet: DcUbHKteCFNpnntJxCfixXvBcB5SGTQxbTz2eeXSr2nn

…ntation

Complete rewrite: the agent is now fully self-contained with zero external
system dependencies. No OpenClaw, no Semgrep, no Python — just Node.js + npm.

Key changes:
- Self-contained agent with Anthropic Claude SDK for AI orchestration
- Octokit for all GitHub operations (discover, audit, submit)
- SKILL.md for Claude Code integration
- Zero system dependencies — works anywhere with Node.js 18+
- 11 security patterns in pure regex (no Semgrep needed)
- AI fix generation with Claude (Anthropic) + SiliconFlow fallback

Closes SolFoundry#861
@lloyd-c137 lloyd-c137 force-pushed the feat/autonomous-bounty-hunting-agent branch from caeb4e1 to c9057d2 Compare May 12, 2026 06:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

🏭 Bounty T3: Full Autonomous Bounty-Hunting Agent

1 participant