duplicate-preflight

Prepares novelty-check search terms and checklists for human duplicate review before bug-bounty submission.

1|Updated Aug 11, 2026
One-click install
npx skills add https://github.com/Maybe4a6f7365/agentic-bug-bounty-framework --skill duplicate-preflight-maybe4a6f7365
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: duplicate-preflight
Source: https://github.com/Maybe4a6f7365/agentic-bug-bounty-framework/tree/main/skills/duplicate-preflight
Command: npx skills add https://github.com/Maybe4a6f7365/agentic-bug-bounty-framework --skill duplicate-preflight-maybe4a6f7365

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Before submitting a bug-bounty finding, you must verify it is not a known duplicate, but querying HackerOne Hacktivity is a human-only step. This Skill prepares everything the human needs — search terms, candidate context, and a checklist — so the novelty gate is enforced without the agent overstepping its boundary. ## Core Features & Use Cases - Search-Term Assembly: Builds a query set from the candidate's own evidence, including endpoint names, vulnerability class synonyms, error messages, and mobile deep-link identifiers. - Checklist Generation: Runs tools/duplicate_preflight_checklist.sh to enumerate findings with a null duplicate_preflight block and emit a Markdown checklist, optionally filtered by severity. - Stop-Condition Gating: Applies the negative-control taxonomy to close duplicates by root cause or below-threshold findings, keeping novelty as an explicit submission gate. - Use Case: After qualifying an IDOR candidate on a target program, run this Skill to generate the preflight checklist and search terms, hand them to a human reviewer who queries Hacktivity, and only proceed to submission once the manifest block is filled. ## Quick Start Run the duplicate preflight for my qualified candidate finding and generate the checklist and search terms for human Hacktivity review.

Frequently Asked Questions about duplicate-preflight

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if a bug bounty finding is a duplicate before submitting?

Assemble search terms from the finding's evidence — endpoint names, vulnerability class synonyms, and error messages — then run the duplicate_preflight_checklist.sh tool to generate a checklist. A human queries HackerOne Hacktivity and records the result in the manifest before submission.

Can an AI agent query HackerOne Hacktivity for duplicate checks?

No. The duplicate_preflight manifest block is human-filled only per the framework contract. The agent prepares search terms and runs the checklist tool, but must never fetch Hacktivity or fabricate preflight data.

When should duplicate preflight run in a bug bounty workflow?

Run a fast preflight right after discovery, before spending significant time on qualification, and a final preflight immediately before submission to catch newly disclosed reports. Both gates are required before treating a finding as submittable.

What counts as a duplicate versus a similar vulnerability class?

A duplicate shares the same root cause, affected asset, exploit path, and impact as a prior report. A similar vulnerability class alone is not a duplicate — distinguish root cause, asset, exploit path, or impact before closing a finding.

How do I filter the duplicate checklist by severity?

Pass the --min-severity flag to the checklist tool, for example ./tools/duplicate_preflight_checklist.sh --min-severity Medium. This limits the generated Markdown checklist to findings at or above that severity.