What problem does it solve? Security researchers waste time triaging noisy static analysis findings that bounty platforms reject as out of scope or non-exploitable. This Skill focuses vulnerability hunting on remotely reachable, user-controlled attack paths that qualify for real bounty payouts. ## Core Features & Use Cases - In-Scope Pattern Detection: Identifies bounty-worthy vulnerability classes including SSRF, auth bypass, SQL injection, command injection, path traversal, deserialization, and auto-triggered XSS with CWE mappings. - Noise Filtering: Explicitly excludes low-signal findings such as local-only pickle loads, CLI-only eval, missing security headers, and self-XSS that platforms routinely reject. - Structured Triage Workflow: Guides scope verification, entrypoint discovery, semgrep-based triage, end-to-end code path reading, and minimal PoC validation. - Use Case: A researcher scanning an open-source project for a Huntr submission runs semgrep, filters out test and demo code, traces user input to a SQL sink in an HTTP handler, confirms exploitability, and drafts a report using the provided template. ## Quick Start Scan this repository for remotely exploitable, bounty-worthy vulnerabilities and draft a report for any confirmed findings.
