agentleFS
Sign inStart free
MasriyanMasriyan/gemini-security-skills/skills/bug-bounty-workflow/SKILL.md

bug-bounty-workflow

Skill4 starsChanged 5 months agoMITView on GitHub

Bug bounty workflow skill for program scope mapping, recon-to-report automation, deduplication against prior submissions, and high-signal reporting on HackerOne, Bugcrowd, Intigriti, YesWeHack, and self-hosted programs. Use to organize bounty work end to end while staying inside program rules.

We split this skill into the rules it gives an agent

1 rule. About 0 are common, 1 is distinctive, and 0 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈1

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Test: auth/authorization, IDOR, SSRF, RCE, business logic, secrets exposure, race conditions.

    line 19

≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Bug Bounty Workflow

Program Rules First

  • Parse and pin the program brief: in-scope, out-of-scope, allowed techniques, rate, retesting, safe harbor, disclosure.
  • Refuse any step that violates program rules or applicable law, even if technically possible.
  • Track per-target state so you never test out-of-scope assets accidentally.

Workflow

  1. Scope ingest: domains, mobile apps, APIs, source repos, partner services; tag each with in/out/maybe and rate.
  2. Recon: passive OSINT, subdomain/asset discovery, screenshot, tech fingerprint, content discovery; store as snapshots.
  3. Triage surface: prioritize high-value endpoints (auth, payments, admin, file upload, SSO, webhook, API gateway).
  4. Test: auth/authorization, IDOR, SSRF, RCE, business logic, secrets exposure, race conditions; minimize impact.
  5. Reproduce cleanly: minimal steps, no extra access, redacted PoC, controlled test accounts.
  6. Dedupe: search prior public disclosures, hacker activity, changelogs; cross-check internal notes.
  7. Report: clear title, severity rationale (CVSS + program rubric), impact narrative, reproduction, remediation.

Quality Bar

  • One vulnerability per report. Chain only when chaining is the bug.
  • Include log/HTTP evidence with secrets redacted, plus suggested fix and detection.
  • Offer collaborative retest after the fix.

Output Contract

  • programs/<name>/scope.yaml, recon/, notes.md, reports/<id>.md, metrics.csv (submissions, accepted, paid, dupes).

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free