What problem does it solve? Bug bounty reports often bury the finding under tangled evidence, disproved hypotheses, and inline curl output, causing triagers at Bugcrowd, HackerOne, Intigriti, or VDPs to misclassify or dismiss valid submissions. This Skill enforces a fixed report structure that separates the attack narrative from the proof so a triager can decide in the first screen. ## Core Features & Use Cases - Fixed section order: Header block with VRT/CVSS, summary, three-part vulnerability description, blockquoted attack path, numbered reproduction steps, V1..Vn validation entries, remediation, and notes. - Evidence discipline: Steps narrate the attack while validation entries hold runnable commands and verbatim responses, with rules for trimming CDN noise, preserving transaction IDs, and proving layer attribution behind a WAF. - Unproven step handling: Marks steps that cannot be observed as named open items with the single test that settles them, instead of deleting or vaguely asserting them. - Use Case: You have a proven OAuth redirect flaw with captured HTTP responses. Use this Skill to produce a submission where the title leads with context, the VRT classification is stated up front, and every claim maps to a numbered validation. ## Quick Start Use the bugbounty-report-format skill to restructure my draft finding about the OAuth redirect flaw into a submission-ready report with separated steps and validation evidence.
