Bug bounty reporting
Personal skills collection for Claude
npx -y skills add Lu1sDV/skillsmd --skill bug-bounty-reportingAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Use when an agent drafts, revises, freezes, or independently verifies a bug bounty vulnerability report, executable PoC, evidence bundle, CVSS rationale, or cleanup proof for HackerOne, Bugcrowd, Intigriti, or a vendor-managed program. The skill maps material claims to exact final-run artifacts.
SKILL.md
3.1 KB, as published. Nobody here has run it
Bug Bounty Reporting
Paramount Points
Verbatim; keep internal:
- Concise - Triagers need simple language, no mince words. Straight to the point reports. Every word create cognitive burden
- Triagers are dumb and lazy - They need ELI5 steps and easy to understand reports; reproduction must be done for the fastest and easiest to understand triaging possible.
- Do not talk like a Robot - LLM written report patterns discourages triagers. Write reprots like a human would do.
Status Rules
| Status | Required evidence |
|---|---|
draft | Exact final PoC lacks full-live evidence |
full-live | Exact final PoC produced uncut end-to-end evidence |
submission-ready | Frozen full-live snapshot passed independent review |
Workflow
- Verify current terms: scope, eligibility, safe harbor, prohibited methods,
limits, disclosure. Record source/date; unconfirmed =
blocked, failed =ineligible. - Read references/report-standard.md.
- Inventory version/config, roles, PoC, evidence, control, cleanup. Track
report, PoC, manifest, review as
pending,complete, orblocked; never invent. - Map claims to evidence; remove, narrow, or qualify unsupported claims.
- Draft one linear repro with decisive outputs, pinned root cause, combined impact-and-severity, and concrete fix.
- Require central config, preflight, collision refusal, assertions, evidence capture, secret-safe logs, and exact cleanup; reuse existing PoC tooling.
- Freeze report, PoC, manifest with hashes/config; edits invalidate review/evidence.
- One independent reviewer checks caveats/precedent, combined impact/severity evidence, and clean execution; the writer cannot self-certify.
- Grant
submission-readyonly to frozen, full-live, independently approved snapshots; otherwise report blockers.
Guardrails
- Use authorized targets, controlled accounts, synthetic data.
- Protect user data/credentials; use fingerprints.
- Never overstate impact, severity, lineage, precedent, or metadata as a usable secret.
- Delete only exact run-owned objects recorded in the cleanup ledger.
- Request one focused decision only when authorization, destructive live action, or materially ambiguous impact cannot be established. Otherwise continue and label gaps honestly.
Completion Check
Do not finish silently with skipped gates. Confirm:
- The primary PoC proves the title and every material claim maps to frozen-run evidence.
- The report excerpt matches final-script output and the negative control proves the boundary.
- Cleanup handles success, failure, and catchable interruption.
- Hashes, version/config, report, PoC, and manifest agree.
- The independent frozen-snapshot review is complete, or the report remains
explicitly
draftorblocked.