Menu

Individual skill

hackerone-report

Draft and file a HackerOne report in the browser, with a proof-of-concept package and demo-video notes. Use to submit or prepare a bug-bounty report.

skills/hunter-utils/hackerone-report/SKILL.md

Read pinned source

Source commit 0c1bc93fd5124e7a862d61c1b434f32ba8790e3a

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Instructions only
Last checked
Nov 5, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
153
Repository last updated
Nov 7, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Filing a HackerOne report

Drive a HackerOne vulnerability submission end to end: verify it's worth filing, write it up concisely, build a reproducible PoC with a video-ready README, fill the submission form in the browser, and hand the irreversible steps back to the user.

## Non-negotiable safety rules

These are hard stops. They protect the user's account and their Signal.

1. **Never enter credentials or 2FA codes.** When the form gates on login, take a screenshot, tell the user to sign in themselves, and wait. Suggest they tick "Remember me for 2 weeks" (HackerOne sessions drop mid-flow otherwise).
2. **Never click the final "Submit Report".** It is an irreversible publish and it spends one of the user's reports. Fill everything, then hand off: the user reviews and submits. State this explicitly up front.
3. **Never attach files the user didn't ask you to**, and don't fabricate PoC output. The in-app browser can't drive the native file picker anyway - the user attaches the zip and the video.
4. **Filing is per-user consent.** Draft freely; the act of submitting is the user's.

## Phase 0 - Dedup pre-flight (do this FIRST, every time)