## https://sploitus.com/exploit?id=5FA59815-1506-5F03-A89E-72343CC91CE4
# 🛡️ Bug Bounty SLM
A web front end for your existing NVIDIA-SLM-powered bug bounty agent system.
The original terminal `app.py` logic — 42 agent system prompts, NVIDIA API
call, conversation loop — is unchanged in spirit; it's just been reorganized
behind a FastAPI backend so a React dashboard can drive it instead of a
terminal prompt.
## Architecture
```
Bug-Bounty-Agents/*.md (42 agent system prompts — your original files)
│
▼
backend/main.py (FastAPI)
├── loads agent files at startup, same selection logic as app.py
├── GET /api/health → SLM/backend status
├── GET /api/capabilities → the 42 capabilities (name, description, category)
├── POST /api/session → picks an agent, opens a conversation
├── POST /api/chat → forwards a message through the session's
│ agent system prompt to the NVIDIA API
│ (same client, same model, same params
│ as the original app.py)
└── DELETE /api/session/{id} → ends a session
│
▼ (JSON over HTTP, CORS-restricted to the frontend origin)
frontend/ (React + Vite)
├── Dashboard — capability grid, search, category filter, live stats
└── ChatWorkspace — per-agent chat, markdown rendering, code-copy, errors
```
The NVIDIA API key never reaches the browser — it lives only in
`backend/.env` and is used server-side.
## What was in your ZIP
- `project/app.py` — terminal chat loop: lists agents from
`Bug-Bounty-Agents/*.md`, loads the chosen file as the system prompt, and
calls `meta/llama-3.1-8b-instruct` via the NVIDIA-hosted OpenAI-compatible
endpoint (`https://integrate.api.nvidia.com/v1`).
- `Bug-Bounty-Agents/` — 48 markdown files. 42 of them are real agents
(recon, web/API, cloud, AD, malware analysis, social engineering, exploit
chaining, reporting, etc.), each with YAML frontmatter (`name`,
`description`) and a system prompt that includes scope/authorization
gates. The rest are repo meta files (`README.md`, `CHANGELOG.md`,
`SECURITY.md`, `CONTRIBUTING.md`, `AGENTS.md`) and one shared prompt
fragment (`_scope-guard.md`) that's explicitly *not* meant to be a
standalone selectable agent.
- A second, separate project (`newslm/BugHunterAI/`) with a different,
more code-driven agent architecture (Python classes per agent, its own
RAG folder). This wasn't touched — the terminal app you referenced in the
prompt is `project/app.py`, so that's what this web app wraps.
## Bug fixed along the way
Your original `app.py` excludes 5 filenames from the agent list but not
`_scope-guard.md`, so the terminal version actually showed **43** selectable
options, and picking #43 would load a broken/partial system prompt (it's a
shared fragment other agents *include*, not a standalone one). The FastAPI
backend excludes it too, restoring the correct count of **42 real
capabilities** — matching what you described.
## What's new
- FastAPI backend (`backend/main.py`) with the 5 endpoints above, in-memory
session store (4-hour TTL), input validation, and safe error responses
(no stack traces leaked to the client).
- Auto-derived `category` per agent (Reconnaissance, Web & API, Cloud &
DevOps, Network & AD, Malware & Forensics, Social Engineering, etc.) from
keyword rules, purely for the UI grid/filter — this doesn't touch the
agent prompts or selection logic at all.
- `description` per agent is pulled straight from each file's own YAML
frontmatter, so nothing was invented.
- React + Vite dashboard: capability grid with search/category filtering,
live health stats, and a two-pane chat workspace (sidebar with the active
agent + status, chat with markdown rendering, copyable code blocks, a
thinking indicator, and inline error/retry).
- Dark "ops terminal" visual theme (amber accent, monospace for
data/labels, subtle background grid) — built to feel like a security
tool, not a generic chat demo.
## What's still on you
- **The NVIDIA API call itself hasn't been tested end-to-end from this
environment** — this sandbox has no network route to
`integrate.api.nvidia.com`, so I verified everything up to that boundary
(agent loading, all 42 capabilities, session lifecycle, error handling,
frontend build, both dev servers running and talking to each other) but
couldn't fire a live chat completion. Your API key has been carried over
into `backend/.env` from your original `project/.env`, so the first real
chat message you send should just work — if it doesn't, it's worth
double-checking the key is still valid and that `meta/llama-3.1-8b-instruct`
is available on your NVIDIA account.
- Streaming isn't wired up (the prompt said implement it only if the
existing setup supports it — the original `app.py` uses a plain, non-streamed
`chat.completions.create` call, so this version matches that with a
request/response chat, plus a "thinking" indicator while waiting).
- Sessions are in-memory (a Python dict) — fine for local/demo use; restart
the backend and open sessions are gone. If you deploy this, swap
`SESSIONS` in `main.py` for Redis or a database.
## Running it
**Backend**
```bash
cd backend
pip install -r requirements.txt
uvicorn main:app --reload
```
Runs on `http://localhost:8000`. Your NVIDIA key is already in `backend/.env`.
**Frontend**
```bash
cd frontend
npm install
npm run dev
```
Runs on `http://localhost:5173` and talks to the backend at
`http://localhost:8000` (override with a `VITE_API_URL` env var if needed).
Open `http://localhost:5173`, pick a capability, and chat.
## Adding a new capability
Drop a new `.md` file into `backend/data/agents/` with the same YAML
frontmatter shape (`name`, `description`, `tools`, `model`) as the existing
ones, restart the backend, and it shows up automatically — no code changes
needed. Filenames starting with `_` are treated as shared fragments and
excluded from the selectable list.
## Troubleshooting
| Symptom | Likely cause |
|---|---|
| "Backend offline" pill in the top bar | FastAPI isn't running, or is on a different port than `VITE_API_URL` expects |
| `/api/chat` returns 503 | `NVIDIA_API_KEY` missing/blank in `backend/.env` |
| `/api/chat` returns 502 | The NVIDIA API call itself failed (bad key, rate limit, model unavailable) — check the backend terminal log for the real exception type |
| Capability grid is empty | `backend/data/agents/` is empty or misplaced relative to `main.py` |