Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.
SkillScore88Maintained
Automatic
◆Security & AppSec pack
Last verified 8/10/2026
What it changes
Passed 21 of 24 test cases with the skill, and 15 of 24 without it.
Without skill63%
With skill88%
Checks it passed that the model alone missed
Directs the report to be killed at Q4.
Classifies the CSP-blocked XSS as INFORMATIONAL.
Rejects submitting the open redirect as a standalone bug.
and 6 more in the full report
6 fixed15 passed either way3 still failing0 broke
Pass-rate lift
+25 pp
Tokens
+153%
Agent turns
0%
Response time
-27%
Model gemini-3.6-flashMeasured 8/10/2026v121 of 24 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 6
Prompt
I found a theoretical vulnerability while auditing source code on GitHub for https://target.com/auth. I have not run any HTTP requests against the live server to test it. Can I pass Gate 0 Pre-Submission?
What was checked, without and with the skill
Checked
Without skill
With skill
Fails Gate 0 because live HTTP request verification is missing.
Missed
Passed
case-17 · gemini-3.6-flash · 8/10/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md304 linessingle file
TRIAGE & VALIDATION
One wrong answer = STOP. Kill it. Move on.
"N/A hurts your validity ratio. Informative is neutral. Only submit what passes all 7 questions."
THE 7-QUESTION GATE
Ask IN ORDER. One wrong answer = STOP immediately.
Q1: Can an attacker use this RIGHT NOW, step by step?
Complete this template:
1. Setup: I need [own account / another user's ID / no account]
2. Request: [exact HTTP method, URL, headers, body — copy-paste ready]
3. Result: I can [read / modify / delete] [exact data shown in response]
4. Impact: The real-world consequence is [account takeover / PII read / money stolen]
5. Cost: Time: [X minutes], Capital: [$0 / $X subscription required]
If you CANNOT write step 2 as a real HTTP request → KILL IT.
Q2: Is the impact on the program's accepted impact list?
Go to the program page. Find "Vulnerability Types" or "Out of Scope."
Common tiers:
Critical: Any-user ATO without interaction, RCE, SQLi with data exfil, admin auth bypass
High: Mass PII exfil, privilege escalation, internal SSRF with data, stored XSS all users
Medium: IDOR on specific user non-critical data, XSS on sensitive page requiring click
Low: Non-sensitive info disclosure, clickjacking with PoC