Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →shuvonsec/report-writing
Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.
Passed 17 of 23 test cases with the skill, and 11 of 23 without it.
and 11 more in the full report
6 fixed11 passed either way6 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
A triager on HackerOne commented on my IDOR report: 'This issue requires authentication so the severity is Low.' How should I write a concise response countering this downgrade attempt?
| Checked | Without skill | With skill |
|---|---|---|
| Rebuts by highlighting that the attacker only requires a standard free account without special permissions | Missed | Passed |
| Avoids passive or defensive phrasing in the rebuttal | Passed | Passed |
The instructions your model reads when the skill loads.
Impact-first. Human tone. No theoretical language. Triagers are people.
Never use "could potentially" or "could be used to" or "may allow". Either it does the thing or it doesn't. If you haven't proved it, don't claim it.
BAD: "This vulnerability could potentially allow an attacker to access user data."
GOOD: "An attacker can access any user's order history by changing the user_id
parameter to the target user's ID. I confirmed this using two test accounts:
[email protected] (ID 123) successfully retrieved [email protected] (ID 456)
orders, including their shipping address and payment method last 4 digits."
Every report-writing session must leave a complete finding folder on disk. Save
the report draft, pre-submit checklist, references, downgrade counters, and final
submission note under findings/<target-or-program>-<bug-class>/. Never rely on
terminal or tmux scrollback for content the hunter needs later.
Minimum files:
findings/<target-or-program>-<bug-class>/
├── hackerone-report.md # or bugcrowd-report.md / intigriti-report.md / immunefi-report.md
├── submission-notes.md # final checklist, references, caveats, next action
└── evidence/ # screenshots, curl output, response bodies when available
If tools/validate.py already wrote submission-notes.md, append/update it
instead of creating a duplicate.
test cases passed, vs 11 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.