skills.rest
luongldptit
luongldptitCOMMUNITY
Explore all skills by this author →
GitHub

security-bounty-hunter

Identify remotely reachable, bounty-eligible security vulnerabilities in software repositories.

Updated Mar 26, 2026
Search Tags:#bug bounty#repository scanning#vulnerability hunting#responsible disclosure#bounty hunting#exploit validation#security triage
One-click install
npx skills add https://github.com/luongldptit/move-ticket --skill security-bounty-hunter-luongldptit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-bounty-hunter
Source: https://github.com/luongldptit/move-ticket/tree/main/.agent/skills/security-bounty-hunter
Command: npx skills add https://github.com/luongldptit/move-ticket --skill security-bounty-hunter-luongldptit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill eliminates the wasted effort of sifting through low-signal, non-bounty eligible security findings during repository reviews, focusing exclusively on exploitable vulnerabilities that qualify for real responsible disclosure or monetary bounty rewards.

Core Features & Use Cases

  • Scope Filtering: Automatically excludes out-of-scope, low-value patterns like local-only code, test-only issues, and generic missing security headers that bounty platforms routinely reject.
  • High-Impact Prioritization: Focuses on remotely reachable, user-controlled attack paths including SSRF, auth bypass, RCE, SQL injection, and XSS flaws that deliver meaningful impact for bounty submissions.
  • Structured Reporting: Provides a standardized report template and pre-submission quality gate to ensure submissions meet program requirements and avoid duplicate tickets.
  • Use Case: A bug bounty hunter scanning a public open-source repository for HackerOne submissions can use this Skill to cut through hundreds of irrelevant static analysis alerts and surface only 2-3 high-impact, reportable vulnerabilities.

Quick Start

Use the security-bounty-hunter skill to review the target open-source repository and generate a triage report of only exploitable, bounty-worthy security vulnerabilities eligible for responsible disclosure or bounty submission.

Frequently Asked Questions about security-bounty-hunter

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find bounty-eligible vulnerabilities in an open-source repository?▼

To find bounty-eligible vulnerabilities, you need to filter out low-signal static analysis alerts and focus on remotely reachable, user-controlled attack paths like SSRF, auth bypass, and RCE. This approach ensures you surface only exploitable flaws suitable for HackerOne or Huntr submissions.

What security issues are automatically filtered out during repository vulnerability hunting?▼

Repository vulnerability hunting filters out local-only code, test-only issues, and generic missing security headers. These low-value patterns are routinely rejected by bounty platforms, so excluding them prevents wasted effort on non-exploitable, out-of-scope findings.

How do I validate exploitability before submitting a bug bounty report?▼

To validate exploitability before a bug bounty submission, apply a structured workflow that enforces focus on remotely reachable, user-controlled attack paths. This pre-submission quality gate ensures your report meets program requirements and avoids duplicate tickets.

Can I use repository scanning for HackerOne submission triage?▼

Yes, repository scanning supports HackerOne submission triage by cutting through hundreds of irrelevant static analysis alerts to surface only high-impact, reportable vulnerabilities. It prioritizes exploitable flaws like SQL injection and XSS that deliver meaningful impact.

What's the best way to generate a compliant bug bounty report?▼

The best way to generate a compliant bug bounty report is to use a standardized template with a pre-submission quality gate. This ensures your responsible disclosure submission meets program requirements, validates exploitability, and avoids duplicate tickets.

Why does static analysis produce low-signal results for bug bounty hunting?▼

Static analysis produces low-signal results for bug bounty hunting because it flags local-only, test-only, and non-exploitable patterns that bounty platforms reject. Filtering these out lets you focus strictly on remotely reachable, user-controlled attack paths.

Related Skills

Explore More Software Engineering Skills→
VenTheZoneVenTheZone
1

hack-scope

Analyze VDP documentation to define security assessment scope boundaries.

Community
Intermediate
timequitytimequity
6

security-check

Scan generated code for OWASP vulnerabilities and produce security reports.

Official
Advanced
mvillmowmvillmow
18

scan-vulnerabilities

Detect security vulnerabilities in code and dependencies with static analysis.

Community
Intermediate
vrcmsvrcms
1

security-bounty-hunter

Identify and validate remotely reachable exploitable security vulnerabilities in a repository.

Community
Advanced