skills.rest
llmh333
llmh333COMMUNITY
Explore all skills by this author →
GitHub

security-bounty-hunter

Identify exploitable security issues reachable via user-controlled attack paths.

Updated Sep 13, 2025
Search Tags:#proof of concept#vulnerability research#exploitability#bug bounty#SSRF#security triage#auth bypass
One-click install
npx skills add https://github.com/llmh333/employee_management_spring --skill security-bounty-hunter-llmh333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-bounty-hunter
Source: https://github.com/llmh333/employee_management_spring/tree/main/.gemini/skills/security-bounty-hunter
Command: npx skills add https://github.com/llmh333/employee_management_spring --skill security-bounty-hunter-llmh333

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you quickly discover security vulnerabilities that are actually exploitable via real user or network paths, producing findings that are more likely to be accepted for responsible disclosure or bug bounties.

Core Features & Use Cases

  • Remotely reachable triage: Prioritizes user-controlled, externally reachable attack paths over low-signal local-only issues.
  • Exploitability-driven workflow: Guides you to confirm user control reaching a meaningful sink and to validate impact with a minimal safe PoC.
  • Bounty-aligned reporting: Produces a report structure geared toward triage and submission requirements (description, vulnerable code, PoC, impact, affected versions), reducing time spent reworking drafts.

Quick Start

Use security-bounty-hunter to triage the repository for exploitable security issues by focusing on remotely reachable vulnerabilities and crafting a minimal PoC for any findings you confirm as in-scope.

Frequently Asked Questions about security-bounty-hunter

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find remotely exploitable vulnerabilities for bug bounty submissions?▼

Triage repository code paths by confirming user control reaches a meaningful sink, then validate exploitability with a minimal safe proof of concept. This workflow prioritizes externally reachable attack paths over low-signal local issues for bug bounty submissions.

What is vulnerability triage for responsible disclosure?▼

Vulnerability triage for responsible disclosure identifies exploitable security issues via remote or user-controlled attack paths, confirming scope and proving user control reaches a meaningful sink before drafting a submission report.

How do I validate SSRF exploitability with a proof of concept?▼

Trace user-controlled input to a meaningful sink and validate impact with a minimal safe proof of concept. This confirms the SSRF vulnerability is remotely reachable and bounty-worthy while avoiding noisy out-of-scope findings.

Does bug bounty triage require confirming user control to a sink?▼

Yes, bug bounty triage requires confirming user control reaches a meaningful sink to validate exploitability. Enforcing this requirement ensures findings are remotely reachable and reduces time spent reworking report drafts.

What is the best way to draft a bug bounty report for security triage?▼

Structure the report with description, vulnerable code, proof of concept, impact, and affected versions. This bounty-aligned format validates exploitability and reduces submission rework time.

When should I not report out-of-scope security findings?▼

Avoid reporting out-of-scope findings that are low-signal local-only issues or lack confirmed user control reaching a meaningful sink. Focusing on remotely exploitable vulnerabilities ensures submissions meet bounty triage requirements.

Related Skills

Explore More Software Engineering Skills→
VenTheZoneVenTheZone
1

hack-scope

Analyze VDP documentation to define security assessment scope boundaries.

Community
Intermediate
sakamoto-family-smilesakamoto-family-smile

security-bounty-hunter

Identify remotely reachable vulnerabilities and produce minimal proof-of-concept submissions.

Community
Advanced
philo-grovesphilo-groves
12

maxtac-sast-control-flow-graph

Construct static analysis graphs for reachability, guard dominance, and path feasibility.

Community
Advanced
zebbernzebbern
4.5k

Red Team Tools and Methodology

Automate red-team reconnaissance and vulnerability discovery workflows.

Community
Advanced