Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →transilienceai/hackerone
HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.
Passed 14 of 17 test cases with the skill, and 5 of 17 without it.
and 13 more in the full report
12 fixed6 passed either way3 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
In a submission report, what artifact script should the numbered steps to reproduce directly mirror?
| Checked | Without skill | With skill |
|---|---|---|
| Mirrors verification-script.py in the reproduction steps. | Missed | Passed |
The instructions your model reads when the skill loads.
Automates: scope parsing → parallel testing per asset → authoritative finding validation → submission reports.
skills/coordination/SKILL.md).validate-findings workflow per asset (authoritative submission gate). Generate HackerOne reports from the validated set ONLY — never submit a finding that is not VALID/REPAIRED.Expected columns:
identifier — asset URL/domain.asset_type — URL, WILDCARD, API, CIDR.eligible_for_submission — must be true.max_severity — critical / high / medium / low.instruction — asset-specific notes.Parse with skills/hackerone/tools/csv_parser.py. Filter for eligible_for_submission=true.
One coordinator per asset, spawned in parallel:
coordinator_role = Read("skills/coordination/SKILL.md")
Agent(prompt=f"{coordinator_role}\n\nTARGET: {asset_url}\nSCOPE: {program_guidelines}\nOUTPUT_DIR: ...",
run_in_background=True)
10 assets → 10 parallel coordinators (~2-4 h vs 20-40 h sequential). Each coordinator follows skills/coordination/SKILL.md and reference/role-matrix.md.
Every finding requires poc.py (executable exploit), poc_output.txt (timestamped execution proof), manual repro steps, and evidence (screenshots / HTTP captures / video). This is the input the validator consumes.
After each asset's coordinator returns, the orchestrator runs the validate-findings workflow for that asset and submits ONLY findings it marks VALID or REPAIRED:
test cases passed, vs 5 / 17 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.