Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →elementalsouls/evidence-hygiene
Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails, phones, faces — vs what is safe to leave — usernames, trace IDs, request bodies), HAR file sanitization (jq filters for Cookie/Set-Cookie/Authorization headers), Burp Repeater/Intruder screenshot hygiene (hide request body, show only Results
Passed 18 of 22 test cases with the skill, and 13 of 22 without it.
and 7 more in the full report
7 fixed11 passed either way2 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
Before taking a full-window DevTools screenshot of an API response, which specific DevTools tab panel must be closed to avoid accidental credential leakage?
| Checked | Without skill | With skill |
|---|---|---|
| Instructs to close the Application Storage Cookies panel before capturing | Missed | Passed |
The instructions your model reads when the skill loads.
Use this skill BEFORE capturing any screenshot, exporting any HAR, or attaching any evidence to a bug-bounty submission. It catches the most common evidence-hygiene mistakes that cause cookies to leak, PII to be shared without consent, or screenshots to be unsuitable for triage.
The core principle: Bug-bounty evidence is meant to convince a triager. Anything beyond that — live cookies, real-user PII, internal trace IDs that aren't useful — should not be in the evidence.
Every PoC artifact (screenshot, HAR, raw HTTP request, terminal transcript) potentially contains data that needs different treatment.
| Category | Examples | Treatment |
|---|---|---|
| Your-account secrets | Session cookies, OAuth tokens, refresh tokens, API keys | Always redact. Even in private bug-bounty platform attachments. Your account, your session — protect it. |
| Other users' PII | Real names, emails, phone numbers, addresses, profile photos, account IDs | Redact unless explicitly demonstrating cross-account impact. Even then, mask faces and minimize the data you display. |
| Triager-useful metadata | Trace IDs (x-datadog-trace-id), request IDs, server timestamps, your test account UID/email, GraphQL operation names, response shapes | Leave visible — these help the triager correlate to logs and reproduce. |
| Test-account passwords (limited use) | Throwaway passwords on a test account (e.g., Testing@5678) | Acceptable in screenshots if you rotate immediately after submission so the value shown is dead. Don't leave real-use passwords in evidence. |
The session cookie value is the highest-value secret in any PoC. Mask:
authn, session, sid, __Secure-id, etc. — name varies per target)csrf-token if it's bound to your sessionAuthorization headers (Bearer tokens, JWT)Cookie request header values for any session-bearing cookieSet-Cookie response header values for any session-bearing cookie__cf_bm, _cfuvid) — these are bot-management, not session-bearingajs_anonymous_id, _ga)x-datadog-trace-id, x-request-id)Server: cloudflare, X-Frame-Options)bugcrowd-reporting)test cases passed, vs 13 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.