skills.rest
jellaharshith
jellaharshithCOMMUNITY
Explore all skills by this author →
GitHub

triage-validation

Validates security-finding reportability using a structured 7-question gate and four pre-submission checks.

1|Updated Apr 18, 2026
Search Tags:#deduplication#security triage#evidence checklist#bug bounty validation#finding gating#CVSS 3.1#severity guidance
One-click install
npx skills add https://github.com/jellaharshith/SWIFT --skill triage-validation-jellaharshith
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: triage-validation
Source: https://github.com/jellaharshith/SWIFT/tree/main/swift/skills/cbh/skills/triage-validation
Command: npx skills add https://github.com/jellaharshith/SWIFT --skill triage-validation-jellaharshith

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill prevents wasting time and submitting invalid security findings by forcing a strict 7-question validation gate and additional pre-submission checks before any report is written.

Core Features & Use Cases

7-Question Gate (ordered stop rules): Disqualifies a finding immediately when step-by-step attackerability, scope acceptance, in-scope asset targeting, realistic access assumptions, novelty/duplication, impact beyond “technically possible,” or known-invalid bug class rules fail. 4 Pre-Submission Gates: Ensures the bug is real, confirms impact quality, performs deduplication against public/disclosed sources, and checks report-quality essentials like title, reproducible steps, evidence, and non-theoretical remediation language. Conditional validity & severity guidance: Uses chain-required vs standalone tables to decide when a finding is only valid after end-to-end exploitation, plus a CVSS 3.1 quick reference and severity decision discipline.

Quick Start

Use the triage-validation skill to evaluate a single draft finding (including your Q1 HTTP request template, proposed impact claim, scope justification, and evidence) before writing any report.

Frequently Asked Questions about triage-validation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate a security finding before submitting a bug bounty report?▼

Deduplication prevents submitting duplicate security findings by requiring explicit searches against public and disclosed sources. This pre-submission check confirms novelty and stops wasted effort on already-known vulnerabilities.

What is the best way to determine if a vulnerability requires end-to-end exploitation to be valid?▼

To determine vulnerability validity, use conditional chain-required versus standalone tables. These rules decide when a finding is only valid after proving end-to-end exploitation versus when it stands alone as a reportable issue.

How do I assign the correct CVSS 3.1 severity score to a validated vulnerability?▼

To assign CVSS 3.1 severity, apply severity decision discipline using a quick reference guide after passing validation. This ensures accurate impact assessment for validated vulnerabilities before report submission.

Why are my bug bounty reports being rejected for theoretical impact?▼

Bug bounty reports are rejected when impact is only technically possible rather than proven. Validation requires confirming evidence and impact beyond technical possibility, explicitly rejecting known-invalid bug patterns and theoretical claims.

Can I use security triage validation for vulnerabilities found outside of bug bounty programs?▼

Security triage validation fits vulnerability research and bug-bounty workflows where reports must be scoped, deduplicated, and evidence-backed. It applies a strict 7-question gate to evaluate any draft finding before writing a report.

Related Skills

Explore More Legal & Compliance Skills→
chrismcmackenchrismcmacken

review-artifacts

Triage artifact scan results to surface reportable bug bounty findings.

Community
Intermediate
NaveedTechLabNaveedTechLab
11

internal-comms

Generate formatted internal communications from company guideline files.

Community
Intermediate
uphiagouphiago
1.1k

bb-methodology

Structure bug bounty sessions with a 5-phase non-linear workflow.

Community
Advanced
dreadnodedreadnode
11

report-writer

Convert validated security findings into structured HackerOne vulnerability reports.

Official
Intermediate