hunter-22: bounty discovery with a one-tap audit handoff to vuln-scanner

.github/README.md

@@ -81,7 +81,7 @@ The prompt *is* the skill. You schedule it, hand it a `var`, chain it into other
   <img src="../docs/assets/packs-aeon.jpg" alt="Six skill packs, 60+ skills total: Core (fleet coordination, self-config, liveness), Evolution (authors and heals its own skills), Basics (simple runnable skills), Dev & Code, Crypto & Markets, and Productivity." width="100%" />
 </p>
 
-<p align="center"><a href="../docs/skill-packs.md#full-catalog-all-73-skills-by-pack"><b>Full catalog - all 73 skills by pack →</b></a></p>
+<p align="center"><a href="../docs/skill-packs.md#full-catalog-all-74-skills-by-pack"><b>Full catalog - all 74 skills by pack →</b></a></p>
 
 <p align="center"><a href="../docs/community-skill-packs.md#listed-packs"><b>Community skill packs →</b></a></p>
 

aeon.yml

@@ -125,6 +125,10 @@ skills:
   write-tweet: { enabled: false, schedule: "0 21 * * *", var: "" } # tweet studio. var: empty=drafts (10×5 tiers) | thread [topic] | remix [window]. Optional XAI_API_KEY (required for remix).
   bd-radar: { enabled: false, schedule: "20 7 * * *", var: "" } # daily 07:20 — BD radar: who's building/forking/integrating/mentioning your products → ranked leads. Products from memory/products.md. Quiet unless high-intent.
 
+  # --- Ported from derivative instances (2026-08-08) ---
+  # Security (pairs with vuln-scanner)
+  hunter-22: { enabled: false, schedule: "0 10 * * *", var: "" } # daily bounty scan against ClawHunter's free discovery API (docs/ClawHunter-API.md) — capability-matched, triaged for real work vs content-farming, dedup'd against memory/topics/hunter-22-seen.json. Discovery only, no wallet, never claims/submits; audit-shaped matches with a linked GitHub repo get a one-tap "run vuln-scanner on it" button in the notification.
+
   # Product / ops (config: memory/products.md)
 
   # Self-maintenance / meta

apps/dashboard/lib/skill-icons.data.ts

@@ -32,6 +32,7 @@ export const SKILL_ICONS: Record<string, string> = {
   "glim-mcp": "<path d='M3 7V5a2 2 0 0 1 2-2h2'/><path d='M17 3h2a2 2 0 0 1 2 2v2'/><path d='M21 17v2a2 2 0 0 1-2 2h-2'/><path d='M7 21H5a2 2 0 0 1-2-2v-2'/><circle cx='12' cy='12' r='3'/><path d='M16 16l-1.9-1.9'/>",
   "heartbeat": "<path d='M22 12h-4l-3 9L9 3l-3 9H2'/>",
   "higgsfield": "<rect x='3' y='4' width='18' height='16' rx='2'/><circle cx='8.5' cy='9.5' r='1.5'/><path d='M3 16l5-4 4 3 3-2 6 4'/><path d='M18 3v3M16.5 4.5h3'/>",
+  "hunter-22": "<circle cx='12' cy='12' r='10'/><circle cx='12' cy='12' r='6'/><circle cx='12' cy='12' r='2'/>",
   "idea-forge": "<path d='M15 14c.2-1 .7-1.7 1.5-2.5a6 6 0 1 0-9 0c.8.8 1.3 1.5 1.5 2.5'/><path d='M9 18h6'/><path d='M10 22h4'/>",
   "idea-pipeline": "<path d='M22 3H2l8 9.5V19l4 2v-8.5z'/>",
   "inbox-triage": "<path d='M22 12h-6l-2 3h-4l-2-3H2'/><path d='M5.5 5.1 2 12v6a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2v-6l-3.5-6.9A2 2 0 0 0 16.8 4H7.2a2 2 0 0 0-1.8 1.1z'/>",

catalog/skill-icons.json

@@ -73,6 +73,7 @@
     "spend-watch": "<path d='M4 4v16h16'/><path d='M20 8l-6 7-4-3-5 5'/><path d='M20 12V8h-4'/>",
     "competitor-monitor": "<path d='M5 3v3M9 3v3'/><rect x='3' y='6' width='6' height='13' rx='3'/><rect x='15' y='6' width='6' height='13' rx='3'/><path d='M9 12h6'/>",
     "higgsfield": "<rect x='3' y='4' width='18' height='16' rx='2'/><circle cx='8.5' cy='9.5' r='1.5'/><path d='M3 16l5-4 4 3 3-2 6 4'/><path d='M18 3v3M16.5 4.5h3'/>",
+    "hunter-22": "<circle cx='12' cy='12' r='10'/><circle cx='12' cy='12' r='6'/><circle cx='12' cy='12' r='2'/>",
     "remotion": "<rect x='2' y='3' width='20' height='18' rx='2'/><path d='M7 3v18M17 3v18'/><path d='M2 9h5M2 15h5M17 9h5M17 15h5'/><path d='M11 9.5l3 2.5-3 2.5z' fill='currentColor' stroke='none'/>",
     "weekly-aeoncard": "<rect x='3' y='4' width='18' height='16' rx='2'/><path d='M3 9h18'/><path d='M8 16v-3M12 16v-5M16 16v-2'/>"
   }

docs/ClawHunter-API.md

@@ -0,0 +1,60 @@
+---
+type: Reference
+title: ClawHunter API
+description: Endpoint reference for clawhunter.fun's bounty-discovery API, used by skills/hunter-22
+tags: [bounties, api, reference]
+resource: https://clawhunter.fun/docs
+---
+
+# ClawHunter API
+
+Base URL: `https://clawhunter.fun/api/v1`
+
+Source: [clawhunter.fun/docs](https://clawhunter.fun/docs).
+
+## Auth
+
+- **Free endpoints**: no key required, rate-limited 60/min per IP.
+- **Paid endpoints**: x402 (USDC on Solana/Base, USDG, or `$CLAWHUNTER` at a 10% discount). **Not used by `hunter-22`** — no wallet configured by default. Don't call these without an explicit, documented wallet-funding decision first.
+
+## Free (discovery) endpoints
+
+| Endpoint | Notes |
+|---|---|
+| `GET /bounties` | Ranked bounty feed. Params: `sort`, `types`, `source`, `requires`, `minReward`, `maxReward`, `q`, `hideExpired`, `limit` |
+| `GET /bounties/{id}` | Single bounty detail + submission guidance |
+| `GET /projects/{mint}` | Coin basics/narrative for a bounty's referenced token |
+| `GET /creators/{address}` | Free trust label (`trusted`/`has paid before`/`unproven`/`new`/`limited history`) |
+| `POST /match` | Match bounties to agent capabilities. Body: `capabilities` (string array), `exact`, `source`, `canDoRealWorld`, `minReward`, `limit` |
+| `GET /tones` | Preset voice library (free tier is the list; applying a tone is paid) |
+| `GET /chat/models` | Model menu + pricing, no charge to list |
+
+## Paid endpoints (x402) — reference only, not wired up
+
+| Endpoint | Price |
+|---|---|
+| `GET /pro/bounties`, `/pro/bounties/match`, `/pro/bounties/{id}` | $0.001 |
+| `GET /bounties/{id}/report` | $0.05 |
+| `GET /projects/{mint}/research`, `/bounties/{id}/research` | $0.03 |
+| `GET /creators/{address}/full` | $0.03 |
+| `POST /tones` | $0.05 |
+| `POST /tones/{id}/apply` | $0.01 |
+| `POST /tools/research`, `/tools/tweet`, `/tools/thread` | $0.03 |
+| `POST /tools/image-prompts` | $0.01 |
+| `POST /tools/image` | $0.04 |
+| `POST /tools/video-director` | $0.05 |
+| `POST /chat/completions` | per-token, ~50% of provider list price |
+
+Paid calls return HTTP 422 (not charged) when the input has insufficient signal — e.g. `/research` on a bounty with no linked coin.
+
+## Response patterns
+
+- `404` — not found
+- `400` — invalid request
+- `413` — input over 200k chars
+- `422` — flagged or insufficient data (paid endpoints: not charged)
+- `502` — upstream error (paid endpoints: not charged)
+
+## Provenance note
+
+`skills/hunter-22` is an independent implementation against the documented public API above — not an installed third-party package, no unverified code pulled in.

docs/skill-packs.md

@@ -167,7 +167,7 @@ enable its skills from the dashboard's Packs view.
 
 ---
 
-## Full catalog (all 73 skills by pack)
+## Full catalog (all 74 skills by pack)
 
 Three packs are shown by default (**Core**, **Evolution**, **Basics**); the rest are revealed on demand.
 
@@ -178,7 +178,7 @@ Three packs are shown by default (**Core**, **Evolution**, **Basics**); the rest
 | **Basics** (`basics`, 17) | <img src="assets/skill-icons/action-converter.svg" width="14" height="14" align="top" alt=""> `action-converter`, <img src="assets/skill-icons/article.svg" width="14" height="14" align="top" alt=""> `article`, <img src="assets/skill-icons/bd-radar.svg" width="14" height="14" align="top" alt=""> `bd-radar`, <img src="assets/skill-icons/digest.svg" width="14" height="14" align="top" alt=""> `digest`, <img src="assets/skill-icons/executor-mcp.svg" width="14" height="14" align="top" alt=""> `executor-mcp`, <img src="assets/skill-icons/fetch-tweets.svg" width="14" height="14" align="top" alt=""> `fetch-tweets`, <img src="assets/skill-icons/github-trending.svg" width="14" height="14" align="top" alt=""> `github-trending`, <img src="assets/skill-icons/glim-mcp.svg" width="14" height="14" align="top" alt=""> `glim-mcp`, <img src="assets/skill-icons/idea-forge.svg" width="14" height="14" align="top" alt=""> `idea-forge`, <img src="assets/skill-icons/last30.svg" width="14" height="14" align="top" alt=""> `last30`, <img src="assets/skill-icons/pr-review.svg" width="14" height="14" align="top" alt=""> `pr-review`, <img src="assets/skill-icons/price-alert.svg" width="14" height="14" align="top" alt=""> `price-alert`, <img src="assets/skill-icons/token-movers.svg" width="14" height="14" align="top" alt=""> `token-movers`, <img src="assets/skill-icons/tx-explain.svg" width="14" height="14" align="top" alt=""> `tx-explain`, <img src="assets/skill-icons/video-script.svg" width="14" height="14" align="top" alt=""> `video-script`, <img src="assets/skill-icons/write-tweet.svg" width="14" height="14" align="top" alt=""> `write-tweet`, <img src="assets/skill-icons/you-web-search.svg" width="14" height="14" align="top" alt=""> `you-web-search` |
 | **Dev & Code** (`dev`, 11) | <img src="assets/skill-icons/changelog.svg" width="14" height="14" align="top" alt=""> `changelog`, <img src="assets/skill-icons/deploy-prototype.svg" width="14" height="14" align="top" alt=""> `deploy-prototype`, <img src="assets/skill-icons/feature.svg" width="14" height="14" align="top" alt=""> `feature`, <img src="assets/skill-icons/github-monitor.svg" width="14" height="14" align="top" alt=""> `github-monitor`, <img src="assets/skill-icons/inbox-triage.svg" width="14" height="14" align="top" alt=""> `inbox-triage`, <img src="assets/skill-icons/posthog-errors.svg" width="14" height="14" align="top" alt=""> `posthog-errors`, <img src="assets/skill-icons/pr-triage.svg" width="14" height="14" align="top" alt=""> `pr-triage`, <img src="assets/skill-icons/seo-audit.svg" width="14" height="14" align="top" alt=""> `seo-audit`, <img src="assets/skill-icons/spend-watch.svg" width="14" height="14" align="top" alt=""> `spend-watch`, <img src="assets/skill-icons/vuln-scanner.svg" width="14" height="14" align="top" alt=""> `vuln-scanner`, <img src="assets/skill-icons/vuln-tracker.svg" width="14" height="14" align="top" alt=""> `vuln-tracker` |
 | **Crypto & Markets** (`crypto`, 14) | <img src="assets/skill-icons/base-mcp.svg" width="14" height="14" align="top" alt=""> `base-mcp`, <img src="assets/skill-icons/defi-overview.svg" width="14" height="14" align="top" alt=""> `defi-overview`, <img src="assets/skill-icons/deploy-uni-hook.svg" width="14" height="14" align="top" alt=""> `deploy-uni-hook`, <img src="assets/skill-icons/distribute-tokens.svg" width="14" height="14" align="top" alt=""> `distribute-tokens`, <img src="assets/skill-icons/finance-district-mcp.svg" width="14" height="14" align="top" alt=""> `finance-district-mcp`, <img src="assets/skill-icons/investigation-report.svg" width="14" height="14" align="top" alt=""> `investigation-report`, <img src="assets/skill-icons/monitor-polymarket.svg" width="14" height="14" align="top" alt=""> `monitor-polymarket`, <img src="assets/skill-icons/narrative-tracker.svg" width="14" height="14" align="top" alt=""> `narrative-tracker`, <img src="assets/skill-icons/onchain-monitor.svg" width="14" height="14" align="top" alt=""> `onchain-monitor`, <img src="assets/skill-icons/picks-tracker.svg" width="14" height="14" align="top" alt=""> `picks-tracker`, <img src="assets/skill-icons/pm-manipulation.svg" width="14" height="14" align="top" alt=""> `pm-manipulation`, <img src="assets/skill-icons/robinhood-mcp.svg" width="14" height="14" align="top" alt=""> `robinhood-mcp`, <img src="assets/skill-icons/token-pick.svg" width="14" height="14" align="top" alt=""> `token-pick`, <img src="assets/skill-icons/unlock-monitor.svg" width="14" height="14" align="top" alt=""> `unlock-monitor` |
-| **Productivity** (`productivity`, 10) | <img src="assets/skill-icons/competitor-monitor.svg" width="14" height="14" align="top" alt=""> `competitor-monitor`, <img src="assets/skill-icons/higgsfield.svg" width="14" height="14" align="top" alt=""> `higgsfield`, <img src="assets/skill-icons/idea-pipeline.svg" width="14" height="14" align="top" alt=""> `idea-pipeline`, <img src="assets/skill-icons/mention-radar.svg" width="14" height="14" align="top" alt=""> `mention-radar`, <img src="assets/skill-icons/operator-scorecard.svg" width="14" height="14" align="top" alt=""> `operator-scorecard`, <img src="assets/skill-icons/remotion.svg" width="14" height="14" align="top" alt=""> `remotion`, <img src="assets/skill-icons/reply-maker.svg" width="14" height="14" align="top" alt=""> `reply-maker`, <img src="assets/skill-icons/schedule-ads.svg" width="14" height="14" align="top" alt=""> `schedule-ads`, <img src="assets/skill-icons/send-email.svg" width="14" height="14" align="top" alt=""> `send-email`, <img src="assets/skill-icons/weekly-aeoncard.svg" width="14" height="14" align="top" alt=""> `weekly-aeoncard` |
+| **Productivity** (`productivity`, 11) | <img src="assets/skill-icons/competitor-monitor.svg" width="14" height="14" align="top" alt=""> `competitor-monitor`, <img src="assets/skill-icons/higgsfield.svg" width="14" height="14" align="top" alt=""> `higgsfield`, <img src="assets/skill-icons/hunter-22.svg" width="14" height="14" align="top" alt=""> `hunter-22`, <img src="assets/skill-icons/idea-pipeline.svg" width="14" height="14" align="top" alt=""> `idea-pipeline`, <img src="assets/skill-icons/mention-radar.svg" width="14" height="14" align="top" alt=""> `mention-radar`, <img src="assets/skill-icons/operator-scorecard.svg" width="14" height="14" align="top" alt=""> `operator-scorecard`, <img src="assets/skill-icons/remotion.svg" width="14" height="14" align="top" alt=""> `remotion`, <img src="assets/skill-icons/reply-maker.svg" width="14" height="14" align="top" alt=""> `reply-maker`, <img src="assets/skill-icons/schedule-ads.svg" width="14" height="14" align="top" alt=""> `schedule-ads`, <img src="assets/skill-icons/send-email.svg" width="14" height="14" align="top" alt=""> `send-email`, <img src="assets/skill-icons/weekly-aeoncard.svg" width="14" height="14" align="top" alt=""> `weekly-aeoncard` |
 
 Authoritative source: [`skills.json`](../catalog/skills.json) + [`packs.json`](../catalog/packs.json), the dashboard **Packs** view, or `bin/add-skill aeonfun/aeon --list`. A skill's pack comes from its `category:` frontmatter.
 

eyebrowlock.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-08-06T15:40:38.024493Z",
+  "generatedAt": "2026-08-08T13:13:45.846218Z",
   "generator": "eyebrow/0.4.1",
   "artifacts": [
     {
@@ -850,6 +850,26 @@
       "contentHash": "sha256-74c3c5e5c0816ea2274dd2b0f94cf3c219536f565eff0db99f1607c22677d4ab",
       "discoveredFrom": "AGENTS.md"
     },
+    {
+      "id": "64f9d4dd69a15346",
+      "tool": "aeon",
+      "scope": "project:.",
+      "type": "skill",
+      "name": "hunter-22",
+      "source": {
+        "kind": "local",
+        "ref": "skills/hunter-22"
+      },
+      "capabilities": {},
+      "files": [
+        {
+          "path": "SKILL.md",
+          "hash": "6a878c97d9d6aa91622692bd5ccb0ac8eaca830d649f378f1f9516f07c68578a"
+        }
+      ],
+      "contentHash": "sha256-455c9de849299360e3ec1bb1f29305c240367e946c74b0c551f1f335927cfa5b",
+      "discoveredFrom": "skills/hunter-22/SKILL.md"
+    },
     {
       "id": "69bc195d40b1d6e7",
       "tool": "aeon",