Individual skill

bug-bounty-reporting-workflow

Class-level workflow for authorized bug bounty / web pentest engagements — covers report language, mandatory validation gate, sensitive-data emphasis, and CORS/API discovery techniques. Use whenever the user asks to "check", "recon", "pentest", or write a bug bounty report for a target.

skills/security/bug-bounty-reporting-workflow/SKILL.md

Read pinned source

Source commit 961a0dd3d2d2f66a07a416ade3b1d4473b64802e

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: No
Observed behavior: Network or broad shell
Last checked: Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 1,019
Repository last updated: Nov 5, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

ai-agent Repository topic
appsec Repository topic
bug-bounty Repository topic
cybersecurity Repository topic
devsecops Repository topic
exploit-validation Repository topic
hermes-agent Repository topic
infosec Repository topic
llm-security Repository topic
nuclei Repository topic
operations Derived category
data Derived category
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 18,829 bytes
SKILL.mdcore · 18,829 bytes
SKILL.mdcore · 18,829 bytes
references/ai-gateway-control-plane-assessment.mddoc · 1,481 bytes
references/ai-gateway-deep-dive.mddoc · 1,687 bytes
references/ai-gateway-newapi-midtrans-librechat-testing.mddoc · 5,873 bytes
references/ai-router-architecture-assessment.mddoc · 3,743 bytes
references/ai-router-registration-testing.mddoc · 7,950 bytes
references/ai-router-testing-playbook.mddoc · 6,889 bytes
references/cors-misconfiguration-testing.mddoc · 5,352 bytes
references/independent-revalidation-standard.mddoc · 4,879 bytes
references/js-bundle-api-endpoint-discovery.mddoc · 3,638 bytes
references/stealthy-recon-recipe.mddoc · 2,460 bytes
templates/validation-summary.mddoc · 1,593 bytes

Read excerpt


# Bug Bounty Reporting Workflow

## Purpose
Encodes durable preferences and validated techniques for bug bounty / web pentest engagements discovered during the monash.edu assessment (Session 2026-08-16). Governs HOW reports are produced and HOW findings are validated, complementing the `reporting` and `web-pentest` skills (which are manually authored and should be consulted for template/structure).

## User Preferences (Hard Requirements)

**1. Report Language = English**
Even if the user communicates in another language (Indonesian, etc.), the bug bounty deliverable MUST be written in English. Explicit user instruction: "berbahasa inggris".

**2. Validation Gate (Mandatory)**
Never add a finding to the report until it is validated with concrete evidence. User instruction: "jika menemukan sesuatu validasi lagi dan masukin ke laporan" (if you find something, validate it again then include it).
- Automated detections (Nuclei) still require manual confirmation before report inclusion.
- Include a **Validation Status Summary** table at report end: `| Finding | Status | Validation Method | Confirmed |`.