bug-bounty-triage
From the author
Bug bounty report triage, validation, and severity escalation. Use when the user provides a bug bounty report to validate, wants to check if a finding is submittable, needs to escalate severity for maximum payout, or says 'triage this', 'validate this report', 'escalate this', 'is this submittable', 'check this bounty report', 'max bounty', or 'will this get accepted'.
Install
npx skills add Sequester-AG/bug-bounty-triage --skill bug-bounty-triage -a claude-code
Installs to .claude/skills/bug-bounty-triage/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 84
Security100
Provenance66
Maintenance100
Licence100
Adoption37
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- bounty-web26zl/cybersec-toolkitUse during the testing phase of a web application bug bounty. Provides OWASP-aligned attack catalog, payload sources, and tool ordering for SQLi, XSS, SSRF, SSTI, IDOR, auth, race conditions, file upload, deserialization. Triggers on "bounty web", "test this app", "web app testing", "h1 web target".Security★ 82
- report-writingelementalsouls/Claude-BugHunterBug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Validation gates and the submittability/always-rejected decision are owned by triage-validation; this skill owns the written report itself (templates, tone, formulas). Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.Writing★ 5.3K
- vulnerability-triage-brocardstrailofbits/skillsThis skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.Security★ 7.8K
- bug-triageskillmds/skillmdTurn a pile of bugs, issues, and error reports into a ranked, actionable plan with reproduction evidence. Ingests GitHub issues via gh, TODO/FIXME scans, error logs, or a pasted list; attempts to reproduce or classify every item (confirmed, unconfirmed, cannot-repro, each with evidence); scores each by user impact times frequency times fix cost times regression risk; clusters duplicates and shared root causes; and emits a ranked table with a per-bug next action plus a suggested first-sprint slice of quick wins totaling at most one day. Use when you say "triage these bugs", "prioritize the backlog", "which bugs should we fix first", "make sense of these error reports", "rank the open issues", or "clean up the issue tracker".Planning★ 190
- incident-severity-triagebetter-isms/grcskillsUse this skill when something is happening now: an alert, a suspicious login, a ransomware note, data sent to the wrong customer, an outage that might be an attack, and someone asks "how bad is this", "classify this incident", "is this a SEV1", "who do we wake up", "is this a breach", "do we need to notify anyone" or "start the incident log". Classifies the incident on the company's own scale in minutes, decides who is called and how fast, flags any regulatory or contractual clock, lists the evidence to preserve, and starts a timestamped triage record that is revisited as facts change.Legal★ 51
- finding-triage26zl/cybersec-toolkitUse to triage a single security finding — from a scanner (SAST/DAST/SCA), an audit, a pentest report, a bug bounty submission, a CVE advisory, or a threat hunt — into a defensible disposition with the required evidence. Produces a ticket-ready writeup: Fixed, Deferred, Accepted Risk, or False Positive. Use when normalizing findings across different sources, deciding whether something is real and reachable, assigning contextual severity, or building an audit trail that survives review six months later. Coordinator skill — route findings from audit, offensive, and detection work here for disposition.Security★ 82
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in