Individual skill
tradecraft-bugbounty-platforms
Understand how the major bug-bounty platforms differ — scope rules, disclosure, triage, and reputation — so you play each correctly. Load when working a program on HackerOne, Bugcrowd, Intigriti, YesWeHack, or Immunefi, on "platform rules", "safe harbor", "VDP vs paid", or before submitting. Signals: a program URL on one of these platforms, a policy/scope page.
skills/tradecraft/tradecraft-bugbounty-platforms/SKILL.md
Source commit ee0e0c50d2f6d941a14b73dd85a2b470d0ab976e
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Not checked yet
- Last checked
- Nov 7, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 27
- Repository last updated
- Oct 14, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- ai-agents Repository topic
- ai-security Repository topic
- application-security Repository topic
- blue-team Repository topic
- bug-bounty Repository topic
- claude-code Repository topic
- codex Repository topic
- detection-engineering Repository topic
- gemini Repository topic
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 2,996 bytes
Read excerpt
# Bug-bounty platform intelligence
## When it applies
You're operating inside a platform's program. The technical work is the same everywhere, but scope
enforcement, disclosure, payout, and reputation mechanics differ — and getting them wrong loses
bounties or violates the rules.
## Why it works
Each platform encodes its own contract. Reading the program's policy through the lens of that
platform's conventions tells you what's actually in scope, what proof triage expects, and how your
report will be judged — before you spend effort.
## Key points per platform
- **Common to all**: the program's policy page is authoritative — read scope, **out-of-scope**,