skills.rest
woohyun212
woohyun212COMMUNITY
Explore all skills by this author →
WebsiteGitHub

bug-bounty-validation

Triage bug bounty findings through gate-driven evaluation and output verdicts.

21|1|Updated Apr 12, 2026
Search Tags:#validation#policy#triage#cvss#submission#bug-bounty
One-click install
npx skills add https://github.com/woohyun212/security-skill --skill bug-bounty-validation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bug-bounty-validation
Source: https://github.com/woohyun212/security-skill/tree/main/bug-bounty-validation
Command: npx skills add https://github.com/woohyun212/security-skill --skill bug-bounty-validation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides a structured decision framework to validate bug bounty findings before submission, reducing invalid, out-of-scope, or low-quality reports.

Core Features & Use Cases

  • 7-Question Gate: ensures only well-documented, impactful findings proceed.
  • Always-Rejected List: automatically rejects common low-quality patterns.
  • Chain Requirement Evaluation: identifies findings that require chaining with a partner vulnerability.
  • 4 Pre-Submission Gates: checks technical proof, scope, impact, and quality before submission.
  • CVSS 3.1 scoring: aligns severity with demonstrated impact to inform prioritization.
  • Final verdict output: clear SUBMIT, KILL, NEEDS CHAIN, or NEEDS IMPROVEMENT guidance.

Quick Start

Feed a vulnerability finding into the workflow to obtain a final verdict and recommended next steps.

Frequently Asked Questions about bug-bounty-validation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate bug bounty findings before submitting a report?▼

Pre-submission triage validates bug bounty findings by applying a 7-Question Gate and an Always-Rejected List to filter out low-quality, out-of-scope, or invalid submissions before you submit them.

What is the best way to triage a vulnerability to decide if it should be submitted or killed?▼

Vulnerability triage evaluates findings through 4 Pre-Submission Gates checking technical proof, scope, impact, and quality, outputting a structured verdict of SUBMIT, KILL, NEEDS CHAIN, or NEEDS IMPROVEMENT.

How do I know if my bug bounty submission requires chaining with another vulnerability?▼

Chain Requirement Evaluation identifies findings that lack standalone impact and require chaining with a partner vulnerability, returning a NEEDS CHAIN verdict to prevent submitting incomplete reports.

Does bug bounty validation automatically calculate CVSS scores for severity reporting?▼

Yes, bug bounty validation applies CVSS 3.1 scoring to align severity with demonstrated impact, providing a CVSS-sourced severity rating to inform the final report and prioritization.

What are the limitations of automated triage for low-quality vulnerability submissions?▼

Automated triage limits invalid submissions by rejecting common low-quality patterns via an Always-Rejected List, but it cannot fix poorly documented findings, instead returning NEEDS IMPROVEMENT for manual refinement.

Can I use pre-submission triage to check if my vulnerability finding is out of scope?▼

Yes, pre-submission triage checks scope compliance during its 4 Pre-Submission Gates evaluation, automatically flagging or rejecting out-of-scope bug bounty findings to save review time.

Related Skills

Explore More Legal & Compliance Skills→
pdparchitectpdparchitect
13

bb-methodology

Orchestrate bug bounty hunting through a five-phase reconnaissance-to-reporting workflow.

Community
Advanced
Kisilev13Kisilev13

report-writing

Generate bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi.

Community
Advanced
dreadnodedreadnode
11

vuln-critic

Filter low-quality and false positive vulnerability findings from scanners and agent output.

Official
Intermediate
pdparchitectpdparchitect
13

report-writing

Generate platform-specific security vulnerability reports with CVSS scoring logic.

Community
Intermediate