exploit-gate

Enforce a pre-submission exploit verification gate for vulnerability reports.

Updated Aug 23, 2026

Search Tags:#vulnerability #verification #evidence #exploit #gate #security-testing #bug-bounty

Ready to run

npx skills add https://github.com/AshtonVaughan/bountyhound --skill exploit-gate

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: exploit-gate
Source: https://github.com/AshtonVaughan/bountyhound/tree/main/bountyhound/skills/exploit-gate
Command: npx skills add https://github.com/AshtonVaughan/bountyhound --skill exploit-gate

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Pre-submission exploit verification gate ensures only verified and evidence-backed vulnerability reports proceed to write or submit.

Core Features & Use Cases

Gate Decision with statuses PROVEN, CLAIMED, PARTIAL, WAF-BLOCKED, NEEDS-PROOF and guidance on next steps.
Evidence Checklist covering server-side, browser-dependent, blind/OOB, and victim-interaction proof requirements.
Claim Protocol: ALWAYS ASK THE USER FIRST before claiming resources or proceeding with escalations.
Program Policy Check to ensure compliance with scoping and allowed tests.
Pre-Report Verification Scan to audit facts, caveats, and chain of verification before reporting.
Anti-Sycophancy Protocol to accommodate new evidence or corrections.
Post-Gate workflow that surfaces non-final results like WAF blocks or NEEDS-PROOF for user review.

Quick Start

Start by initiating the gate evaluation for a vulnerability report and complete the evidence checklist before submission.

Frequently Asked Questions about exploit-gate

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is a pre-submission exploit verification gate in bug bounty programs?▼

A pre-submission exploit verification gate ensures only evidence-backed vulnerability reports proceed to submission. It enforces an evidence checklist, policy checks, and claim protocols to guide analysts and prevent unverified claims from being reported.

How do I verify vulnerability evidence before submitting a security report?▼

To verify vulnerability evidence before submitting, complete an evidence checklist covering server-side, browser-dependent, blind/OOB, and victim-interaction proof. Run a pre-report verification scan to audit facts and confirm the chain of verification.

Can I submit a vulnerability report if a WAF blocks my exploit?▼

If a WAF blocks your exploit, the gate decision matrix surfaces it as a non-final WAF-BLOCKED status for user review. This post-gate workflow ensures you review the block before proceeding rather than submitting an incomplete report.

How do I handle blind or out-of-band vulnerability proof in responsible disclosure?▼

For blind or out-of-band vulnerability proof in responsible disclosure, the evidence checklist requires specific OOB proof requirements. The gate evaluates these claims and assigns statuses like PROVEN or NEEDS-PROOF to ensure proper verification before submission.

Does the exploit gate check program scope and allowed tests before submission?▼

Yes, the exploit gate includes a Program Policy Check to ensure compliance with scoping and allowed tests. This prevents analysts from submitting reports that violate bug bounty program rules during the pre-submission process.

Why does the vulnerability gate ask before claiming resources or escalating?▼

The vulnerability gate uses a Claim Protocol that always asks the user first before claiming resources or proceeding with escalations. This anti-sycophancy protocol accommodates new evidence or corrections, ensuring user control over security testing actions.