skills.rest
AKasem1
AKasem1COMMUNITY
Explore all skills by this author →
WebsiteGitHub

bugcrowd-reporting

Align Bugcrowd submissions to correct VRT mappings and severity requests.

Updated Aug 27, 2026
Search Tags:#security reporting#bug bounty#vrt#vulnerability disclosure#bugcrowd#severity request#oos rebuttal
One-click install
npx skills add https://github.com/AKasem1/claude-bug-bounty --skill bugcrowd-reporting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bugcrowd-reporting
Source: https://github.com/AKasem1/claude-bug-bounty/tree/main/skills/bugcrowd-reporting
Command: npx skills add https://github.com/AKasem1/claude-bug-bounty --skill bugcrowd-reporting

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill reduces rejected or downgraded Bugcrowd submissions by guiding researchers to choose the right VRT category, request the correct technical severity when the default is wrong, and rebut common OOS auto-close objections with program-aware language.

Core Features & Use Cases

  • Bugcrowd-specific VRT selection: Uses a search-and-fallback hierarchy so the dropdown maps to the closest accurate vulnerability taxonomy instead of defaulting to an overly generic severity.
  • Manual severity override guidance: Explains when and how to override the auto-suggested Technical Severity to reflect real impact, including chain-based escalation.
  • Severity-request paragraph template: Provides a standardized “Severity request — please review carefully before applying VRT default” section to place first in the report body.
  • OOS clause rebuttal templates: Offers targeted “In-scope justification” templates for common close reasons (rate limiting on the wrong endpoint type, debug-info framing, user enumeration where PII is meaningful, and theoretical-issue arguments).
  • Chained submission cross-references: Helps structure chain consumers and primitives using submission UUID cross-links while respecting the “one fix = one bounty” rule.
  • QA vs production target selection: Guides selection of the appropriate scope/target label and includes a QA-testing disclaimer pattern when required.
  • Researcher hygiene for Bugcrowd flow: Recommends friendly-tester posture practices (Bugcrowdninja alias), account state restoration, and session/cookie rotation after submitting evidence.
  • Multi-finding submission ordering: Suggests an order that preserves credibility by filing the strongest, best-evidenced issue first and keeping OOS-risky items later.

Quick Start

Use the bugcrowd-reporting skill when filing a Bugcrowd submission and you need help picking the correct VRT, writing a first-section severity request, and including an in-scope justification for likely OOS objections.

Frequently Asked Questions about bugcrowd-reporting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I pick the correct Bugcrowd VRT category to avoid severity downgrades?▼

To pick the correct Bugcrowd VRT category, use a search-and-fallback hierarchy that maps your submission to the closest accurate vulnerability taxonomy instead of defaulting to an overly generic severity rating.

How do I rebut an out-of-scope auto-close on a Bugcrowd vulnerability report?▼

To rebut an out-of-scope auto-close on a Bugcrowd vulnerability report, use targeted in-scope justification templates that counter common close reasons like rate limiting on the wrong endpoint type, debug-info framing, or theoretical-issue arguments.

How do I request a severity override when the Bugcrowd VRT default underrates impact?▼

To request a severity override when the Bugcrowd VRT default underrates impact, place a standardized severity-request paragraph at the top of the report body asking triagers to review carefully before applying the default.

What is the best way to structure chained vulnerability submissions on Bugcrowd?▼

The best way to structure chained vulnerability submissions on Bugcrowd is to use submission UUID cross-links for chain consumers and primitives while strictly respecting the one fix equals one bounty rule.

When should I use QA testing targets versus production targets for Bugcrowd submissions?▼

You should select QA testing targets versus production targets based on the appropriate scope label, including a QA-testing disclaimer pattern in your submission when required by the specific Bugcrowd program.

Why does the order of multiple findings matter when filing Bugcrowd reports?▼

The order of multiple findings matters for Bugcrowd reports because filing the strongest, best-evidenced issue first preserves credibility, while keeping OOS-risky items for later prevents premature report closures.

Related Skills

Explore More Product & Management Skills→
jellaharshithjellaharshith
1

bugcrowd-reporting

Guide Bugcrowd vulnerability report authors through VRT selection and severity overrides.

Community
Advanced
cybersecwomancybersecwoman
5

bugcrowd-reporting

Select VRT categories and override severity levels for Bugcrowd reports.

Community
Advanced
alexsandrocruzalexsandrocruz

security-patterns

Model and implement OWASP-aligned security patterns for ABP Framework projects.

Community
Advanced
pdparchitectpdparchitect
13

bugcrowd-reporting

Generate Bugcrowd severity-request paragraphs and OOS rebuttal templates.

Community
Intermediate