What problem does it solve? Security researchers risk testing unauthorized assets or submitting non-qualifying findings when they misread bug-bounty program policies. This Skill gates every engagement on two non-technical checks — in_scope (asset and technique authorized) and program_reportable (impact meets the program's threshold) — so no testing or submission happens without verified authorization. ## Core Features & Use Cases - Scope qualification at target entry: Reads the live program policy and the target contract.yaml, builds an in-scope allowlist of assets and permitted techniques, and sets required identification headers and rate budgets. - Reportability qualification before submission: Re-reads the live policy to confirm demonstrated impact meets the severity/reward threshold and was not achieved via an excluded method, then gates handoff on contract.yaml pre-flight flags. - Stop-condition enforcement: Applies labeled negative-control categories (out_of_scope_asset, prohibited_test_method, below impact threshold) so candidates that fail any gate are never advanced. - Use Case: Before running recon against a new HackerOne target, load this Skill to parse the program policy into an allowlist, configure the X-Bug-Bounty header and 1 req/s rate budget, and block any asset not explicitly authorized. ## Quick Start Check whether this asset and testing technique are in scope for the program before I start recon, and re-verify reportability before I submit the finding.
