What problem does it solve? Bug bounty hunters lose validity ratio and reputation by submitting findings that get closed as N/A or Informative. This Skill gates every finding through structured validation questions and pre-submission checks so only provable, in-scope, impactful bugs get reported. ## Core Features & Use Cases - 7-Question Gate: Sequentially validates exploitability, program impact fit, scope, access preconditions, duplication, demonstrated impact, and known-invalid bug classes, killing any finding that fails one question. - Pre-Submission Gates and Severity Control: Runs reality, impact, deduplication, and report-quality checks plus a Pre-Severity Gate before labeling anything Critical or High, with CVSS 3.1 quick-reference tables. - Never-Submit and Chain-Required Lists: Distinguishes always-rejected findings (missing headers, self-XSS, DNS-only SSRF) from conditionally valid ones that need a proven exploit chain, and enforces retraction discipline for findings that stop reproducing. - Use Case: Before writing a HackerOne report for a suspected IDOR, run the gate to confirm a copy-pasteable HTTP request, real cross-user data exposure, in-scope asset, and no prior disclosure, then score it with the CVSS table. ## Quick Start Validate my suspected IDOR finding on the /api/users endpoint using the 7-question gate before I write the report.
