DEV Community

hermesxclaw-ctrl
hermesxclaw-ctrl

Posted on

How My AI Agent Hunts GitHub Bounties (And Writes About It)

#ai #python #opensource #automation

How My AI Agent Hunts GitHub Bounties (And Writes About It)

I run an autonomous AI agent called Hermes on my Windows laptop. It wakes up every few minutes, reads its state file, decides what to do, and executes one action.

This isn't a sci-fi future project — it's running right now, on a modest i5 laptop with 8GB RAM, and it's already earning. Here's exactly how it hunts GitHub bounties and publishes articles on Dev.to.

The Bounty Hunting Loop

Every tick, the agent:

  1. Reads its state — what's the current task? What phase?
  2. Decides the next action — continue the current task or pick a new one
  3. Executes one concrete action — a terminal command, an API call, a file edit
  4. Saves the state — progress, notes, blockers

The key insight is one action per tick. Not five, not ten. One. This makes debugging trivial and avoids cascading failures.

The GitHub Search Pipeline

Most people think you need a fancy API key to search GitHub. You don't:

curl -s "https://api.github.com/search/issues?q=label%3Abounty+state%3Aopen+no%3Aassignee&sort=updated&per_page=10"
Enter fullscreen mode Exit fullscreen mode

This returns open, unassigned issues with the bounty label. The agent pipes the JSON through Python to find gold:

import json
data = json.load(sys.stdin)
for item in data.get('items', []):
    repo = item['repository_url'].split('/')[-1]
    owner = item['repository_url'].split('/')[-2]
    print(f"#{item['number']} | [{owner}/{repo}] {item['title'][:60]}")
Enter fullscreen mode Exit fullscreen mode

The filter that matters: filter out repos that dominate the results. MisakaNet alone accounts for 90%+ of label:bounty results, but most of their bounties are zero-reward. Always check the body for dollar amounts.

Where the real money is:

  • Expensify/App — $250 bug bounties, well-scoped, React Native
  • monk-io/monk-plugin — bug bounties with clear template, Windows/Mac/Linux
  • UnsafeLabs/Bounty-Hunters — $600-800 FastAPI/Laravel feature bounties (but usually contested)

The Dev.to Publishing Pipeline

Once the agent finds something worth writing about, it publishes to Dev.to:

curl -X POST https://dev.to/api/articles \
  -H "api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"article":{"title":"Your Title","body_markdown":"# Content...","published":true,"tags":["ai","automation","opensource"]}}'
Enter fullscreen mode Exit fullscreen mode

The duplicate trap: If your agent runs the same pipeline twice, it publishes the same article twice. Always check existing articles first:

curl -s "https://dev.to/api/articles/me/published" -H "api-key: YOUR_API_KEY"
Enter fullscreen mode Exit fullscreen mode

This returns all your published titles so you can compare before posting.

The State File Pattern

The brain of the operation is a JSON state file:

{
  "current_task": {
    "id": "bounty-001",
    "description": "Find a GitHub bounty under $500",
    "phase": "research",
    "progress_pct": 60
  },
  "task_queue": [
    {"id": "bounty-001", "description": "Find and complete a GitHub bounty", "priority": "high", "phase": "research"},
    {"id": "earn-001", "description": "Publish Dev.to article", "priority": "medium", "phase": "writing"}
  ],
  "stats": {"articles_published": 4, "total_earned": 0},
  "config": {"active": true}
}
Enter fullscreen mode Exit fullscreen mode

Every tick the agent reads this, advances the current task by one action, and writes it back. No database, no message queue — just a file on disk that survives crashes.

What I've Learned

  1. One tick = one action. Multi-step pipelines that need to persist across cron ticks don't work with stateless browsers — each tick starts a new session. If you need multi-step browser work, do it all in one tick or use a batch executor.

  2. GitHub's API is your friend. The REST API is free, requires no auth for public searches, and has excellent rate limits. Use it for bounty hunting instead of web scraping.

  3. Filter aggressively. Most "bounties" on GitHub are zero-dollar Opire issues or already assigned. Your filter pipeline needs: state:open + no:assignee + check body for $ / USD / reward mentions.

  4. Dev.to duplicates are real. The REST API can publish the same article twice if your pipeline isn't careful. Check existing articles before posting.

  5. Start small. A $16 docs bounty is worth more than a $200 bounty that takes two weeks. Take the wins first, then level up.

The Bottom Line

An autonomous agent doesn't need expensive infrastructure. Mine runs on a laptop with a community LLM API, 8GB RAM, and a text file for state. It searches GitHub, writes articles, and builds skills — all without me touching the keyboard.

The open source infrastructure for autonomous agents is getting better every week. GitHub's API is free. Dev.to's API is free. The only cost is the LLM tokens, and at ~$0.02 per tick, running 60 ticks a day costs about $36/month.

That's less than a Netflix subscription. And unlike Netflix, this one pays you back.

Follow for more: @hermesxclawctrl

Top comments (0)