skills.rest
Wyl-cmd
Wyl-cmdCOMMUNITY
Explore all skills by this author →
GitHub

report-writing

Writes impact-first bug bounty reports for HackerOne, Bugcrowd, Intigriti, and Immunefi.

6|Updated Jan 31, 2026
Search Tags:#penetration testing#report writing#bug bounty#hackerone#severity assessment#vulnerability disclosure#cvss scoring
One-click install
npx skills add https://github.com/Wyl-cmd/kxns-cli --skill report-writing-wyl-cmd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: report-writing
Source: https://github.com/Wyl-cmd/kxns-cli/tree/main/src/kxns_cli/skills/report-writing
Command: npx skills add https://github.com/Wyl-cmd/kxns-cli --skill report-writing-wyl-cmd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security researchers often lose payouts because their vulnerability reports are vague, theoretical, or formatted for the wrong platform, causing triagers to downgrade or dismiss valid findings. ## Core Features & Use Cases - Platform-Specific Templates: Provides ready-to-use report structures for HackerOne, Bugcrowd, Intigriti, and Immunefi, each matching that platform's triager expectations and severity mechanisms. - Severity & CVSS Guidance: Includes CVSS 3.1 and 4.0 quick scoring tables, a severity decision guide, and downgrade counters to defend your severity claim against triager pushback. - Impact-First Writing Rules: Enforces a title formula, proven-impact-only language (no "could potentially"), and a 60-second pre-submit checklist. - Use Case: After validating an IDOR finding on a target's API, use this Skill to produce a Bugcrowd report with the correct VRT category, a copy-paste-ready HTTP request, a CVSS vector string, and a severity-request paragraph. ## Quick Start Write a HackerOne report for my validated IDOR finding on the /api/users/{id}/orders endpoint using two test accounts.

Frequently Asked Questions about report-writing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a bug bounty report for HackerOne?▼

Structure the report with a one-paragraph summary stating exact impact, vulnerability details with a CVSS 3.1 score, numbered reproduction steps with exact HTTP requests and responses, quantified impact, and a short recommended fix. Keep it under 600 words and lead with impact in the first sentence.

What is the best title format for a vulnerability report?▼

Use the formula: [Bug Class] in [Exact Endpoint/Feature] allows [attacker role] to [impact] [victim scope]. For example, "IDOR in /api/v2/invoices/{id} allows authenticated user to read any customer's invoice data." Specific titles get triaged faster than vague ones.

How do I calculate a CVSS 3.1 score for my finding?▼

Pick values for the eight metrics: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and Confidentiality/Integrity/Availability impacts. The skill provides typical scores by bug class, such as 6.5 for IDOR reading PII and 9.1 for SSRF reaching cloud metadata.

What is the difference between Bugcrowd VRT and CVSS severity?▼

Bugcrowd maps findings to its Vulnerability Rating Taxonomy with default priorities, which disagree with CVSS roughly 30% of the time. When the VRT default is lower than your CVSS score, file a severity-request paragraph citing the CVSS vector string and the matching VRT entry.

Why do bug bounty reports get marked as not applicable?▼

Reports get N/A when they claim theoretical impact using phrases like "could potentially" without demonstrating the attack end-to-end. Either show the full exploit chain with real request/response evidence on test accounts, or downgrade the severity claim to match what you actually proved.

When should I use CVSS 4.0 instead of CVSS 3.1?▼

Use CVSS 4.0 when the program requires it, as it replaced CVSS 3.1 in November 2023. CVSS 4.0 adds Attack Requirements and sub-impact metrics while removing Scope. Include the full vector string starting with CVSS:4.0/ so programs cannot dispute the score.

Related Skills

Explore More Software Engineering Skills→
pdparchitectpdparchitect
13

triage-validation

Validate security findings through a 7-question gate and pre-submission checklist.

Community
Advanced
EntroVyxEntroVyx
3

report-writing

Generate structured security vulnerability reports with CVSS scoring for bug bounty platforms.

Community
Intermediate
AKasem1AKasem1

evidence-hygiene

Redact session cookies, authorization tokens, and PII from bug-bounty screenshots and HAR exports.

Community
Advanced
hhjkjkjkhhjkjkjk

redteam-report-template

Generates client-facing red-team engagement reports in a six-section finding format with DOCX export.

Community
Intermediate