hunter-22

> **${var}** — optional filter. Empty → default capability match (see below). `types:<a,b>` → restrict to bounty types (e.g. `types:code,research`). `min:<usd>` → minimum reward floor.

Today is ${today}.

## What this is

[ClawHunter](https://clawhunter.fun) is a paid API that indexes crypto/social bounty venues and ranks opportunities. This skill calls its **free discovery tier only** — no API key, no wallet, no payment. Read `docs/ClawHunter-API.md` in this repo for the endpoint reference (base URL, auth, rate limits).

This is **discovery only** for anything requiring human judgment or funds — it never claims, submits, or executes a bounty, and never touches a wallet. It surfaces candidates for the operator to act on manually, with one exception: when a match is real audit-shaped work (code/security, with a linked GitHub repo), the notification carries a button that dispatches `vuln-scanner` at that repo — the operator still taps to trigger it, this skill never dispatches on its own. Do not call any `$` (paid, x402) endpoint in this skill; those require a funded wallet this fork does not have configured.

## What to do

1. Read `memory/topics/hunter-22-seen.json` if it exists (dedup log — bounty IDs already surfaced, with the timestamp last seen). Create it empty (`[]`) if missing.
2. Call `POST https://clawhunter.fun/api/v1/match` with a JSON body describing this agent's real, demonstrated capabilities — not aspirational ones:
   ```json
   {
     "capabilities": ["code", "security-research", "research", "writing", "dependency-analysis"],
     "canDoRealWorld": false,
     "minReward": 20,
     "limit": 25
   }
   ```
   `canDoRealWorld: false` — this agent has no wallet/payment rails configured, so exclude bounties requiring on-chain execution or payment. Do NOT set `canDoRealWorld: true` unless a wallet has actually been funded and documented in `memory/topics/` — check first.
3. If `${var}` sets `types:` or `min:`, adjust the request accordingly (`types` filters the bounty `types` field, `min` overrides `minReward`).
4. Triage the response same as any other discovery skill — **be honest, not generous**:
   - Drop anything that's really a content/social-growth task in disguise (tweet threads, engagement farming, influencer voice-cloning, "get a streamer/creator to post X" outreach). A `requires` array that's only `engage`/`outreach`/`video`/`image` with no `code`/`onchain` is the tell — this agent has no content-generation or social-outreach tooling wired up and can't credibly deliver those.
   - Keep bounties that map to real work: code fixes, dependency/security review, technical writing, structured research with citable sources — the kind of work already demonstrated in `output/articles/vuln-scan-*.md`.
   - For each kept candidate, sanity-check the reward is real (not vaporware) and the deadline is actually reachable.
5. **Flag audit-shaped candidates.** For each candidate that survives step 4, check whether it's actually a code-security audit: `requires` includes `code` or `onchain`, **and** the bounty's `body`/`url` contains a GitHub repo link (`github\.com/[\w.-]+/[\w.-]+`). If both hold, extract `owner/repo` — this is exactly the Veilo-bounty shape (a Superteam listing naming a specific on-chain program's source repo). Not every kept candidate will have one; most won't.
6. Diff against `memory/topics/hunter-22-seen.json` — only report bounties not already seen in the last 14 days.
7. Update `memory/topics/hunter-22-seen.json`: append `{id, title, reward, seen_at}` for every candidate returned this run (seen or not — this keeps the dedup window accurate even for ones that got filtered out, so they don't get re-evaluated every day for no reason). Prune entries older than 30 days.
8. If there are new, genuinely-good matches: `./notify` with a short, decision-grade list — title, reward, venue, one-line why-it-matches, link. Lead with the count and the best one. For any match flagged audit-shaped in step 5, add an inline button so the operator can dispatch the audit in one tap:
   ```bash
   ./notify -f /tmp/hunter22-notify.md --buttons '[[
     {"text":"Audit owner/repo","callback_data":"run:vuln-scanner:owner/repo"},
     {"text":"Open bounty","url":"<bounty url>"}
   ]]'
   ```
   `callback_data` has a hard 64-byte limit (see `docs/telegram-commands.md`) — `run:vuln-scanner:owner/repo` fits comfortably for any realistic repo path. If more than one candidate this run is audit-shaped, send one notify per candidate (each with its own button row) rather than merging them, so a tap is unambiguous about which repo it targets.
   If nothing new or nothing real survived triage, do **not** notify (see CLAUDE.md: "notify only on signal").
9. Commit `memory/topics/hunter-22-seen.json` with an updated `timestamp:`.

## Guardrails

- Never call a paid (`$`) endpoint. Never touch `/tools/*`, `/chat/completions`, or anything billed via x402 in this skill.
- Never claim or submit a bounty on the operator's behalf — this skill only surfaces candidates, and the audit-dispatch button in step 8 still requires a human tap, not an automatic trigger.
- If the API is unreachable or rate-limited, log it and exit quietly — do not retry aggressively (60/min per IP is the documented ceiling; this runs once daily, nowhere close).