review-artifacts

Name: review-artifacts
Availability: InStock
Author: chrismcmacken

Triage artifact scan results to surface reportable bug bounty findings.

Updated Dec 25, 2025

Search Tags:#secrets #inventory #artifact #PII #findings #bug-bounty #artifact-results

Ready to run

npx skills add https://github.com/chrismcmacken/bounty-hunter --skill review-artifacts

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: review-artifacts
Source: https://github.com/chrismcmacken/bounty-hunter/tree/main/.claude/skills/review-artifacts
Command: npx skills add https://github.com/chrismcmacken/bounty-hunter --skill review-artifacts

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security teams triage artifact scan results (archives, SQL dumps, binary databases, and source backups) to surface high-confidence, reportable bug bounty findings.

Core Features & Use Cases

Artifact analysis: Reviews artifact results to identify real-world exposure risks.
Structured reporting: Uses templates to document findings with impact and remediation.
Scope-aware review: Distinguishes between schema-only dumps and real data.
Use Case: When an org stores artifact dumps, this skill surfaces PII exposures or secret leakage for further investigation.

Quick Start

Quick Start:

Step 1: Run the artifact extraction and review pipeline: ./scripts/extract-artifact-findings.sh <org> summary
Step 2: Inspect the organized findings in findings/<org>/artifact-results
Step 3: Run the detailed extraction: ./scripts/extract-artifact-findings.sh <org> full

Frequently Asked Questions about review-artifacts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I triage artifact scan results to find reportable bug bounty findings?▼

The skill reviews artifact scan results to distinguish between schema-only dumps and real data exposures, verifying exploitability and security impact before generating structured bug bounty reports with remediation guidance.

What types of artifact formats can be analyzed for PII exposures and secret leakage?▼

It extracts and inspects archives, SQL dumps, binary databases, and source backups to reveal real data exposures, distinguishing schema-only dumps from actual sensitive data to verify security impact.

Can I use artifact triage scripts to scan across multiple orgs and repositories?▼

Yes, the extraction pipeline processes artifacts across multiple orgs and repositories, organizing findings into dedicated directories for each organization to enable systematic review of security exposures.

How do I extract and organize artifact findings for security analysis?▼

Run the extraction script with an organization name and summary or full mode, then inspect the organized findings in the artifact-results directory to review verified security exposures and misconfigurations.

Does artifact triage verify exploitability before reporting bug bounty findings?▼

Yes, the triage process uses extraction scripts and templates to verify exploitability and security impact before reporting, ensuring only high-confidence, reportable findings are surfaced for bug bounty submissions.