Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.
日本語の概要は準備中です。原文の説明を表示しています。
Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.
日本語の概要は準備中です。原文の説明を表示しています。
Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.
日本語の概要は準備中です。原文の説明を表示しています。
Complete reference for 25 web2 bug classes with root causes, detection patterns, bypass tables, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC (PKCE, state, alg confusion, OIDC discovery-document misconfig, Spring x-application-context leak, .env/404 differential, Kong gateway version disclosure, actuator index footprint), file upload (10 bypasses), GraphQL, LLM/AI (ASI01-ASI10 + MCP/RAG/vector poisoning), API misconfig (mass assignment, JWT attacks, prototype pollution, CORS), ATO taxonomy, SSTI, subdomain takeover, cloud/infra, HTTP smuggling, cache poisoning, MFA bypass (7 patterns), SAML attacks, error disclosure/debug endpoints, CSS injection, LFI->RCE (filter chain RCE, log poisoning, polyglot .user.ini), insecure deserialization (PHP phar, Java ysoserial, Python pickle, Node node-serialize). Use when hunting a specific vuln class or studying what makes bugs pay.
日本語の概要は準備中です。原文の説明を表示しています。
Smart contract security audit — 11 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy, BFT/consensus/liveness), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.
日本語の概要は準備中です。原文の説明を表示しています。
Drive a **locally-running open-kritt stack** (github.com/Kritt-ai/open-kritt) from Hermes for bug-bounty code audits. open-kritt is a self-hosted Docker platform that orchestrates AI agents (Codex / Claude Code) to find real vulnerabilities in a target repo, de-duplicates, and severity-ranks the findings. Use this skill when the user asks to scan/audit a GitHub repo or a local codebase with kritt, wants AI-driven vulnerability discovery on a Solidity/ Rust/JS/Go project, or references "open-kritt" / "kritt scan". The skill talks to the kritt backend REST API at http://127.0.0.1:3002/api (override with KRITT_BACKEND_URL), so the Docker stack must be running first (`./kritt start` in the cloned repo). Capabilities: list workflows / post-scripts / local repos, launch a scan against a remote GitHub repo or a registered local folder, poll until complete, and pull ranked findings. Findings feed naturally into the bug-bounty / web3-audit workflows for PoC + reporting.
日本語の概要は準備中です。原文の説明を表示しています。
Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities.
日本語の概要は準備中です。原文の説明を表示しています。
Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.
日本語の概要は準備中です。原文の説明を表示しています。
Provide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive techniques for capturing, analyzing, and documenting network protocols for security research, interoperability, and debugging.
日本語の概要は準備中です。原文の説明を表示しています。
Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.
日本語の概要は準備中です。原文の説明を表示しています。
Implement proven methodologies and tool workflows from top security researchers for effective reconnaissance, vulnerability discovery, and bug bounty hunting. Automate common tasks while maintaining thorough coverage of attack surfaces.
日本語の概要は準備中です。原文の説明を表示しています。
Expert reverse engineer specializing in binary analysis, disassembly, decompilation, and software analysis. Masters IDA Pro, Ghidra, radare2, x64dbg, and modern RE toolchains.
日本語の概要は準備中です。原文の説明を表示しています。
Determine the minimal technical root cause of candidate security findings, separate causes from symptoms, cluster duplicates, and identify shared vulnerable abstractions.
日本語の概要は準備中です。原文の説明を表示しています。
Smart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan, signature replay, and MEV-related attack patterns.
日本語の概要は準備中です。原文の説明を表示しています。
Secret Scanner - Auto-activating skill for Security Fundamentals. Triggers on: secret scanner, secret scanner Part of the Security Fundamentals skill category.
日本語の概要は準備中です。原文の説明を表示しています。
Adversarial security finding triage — decide whether a candidate finding is real, reachable, exploitable, and in-scope by actively trying to falsify it before it reaches report-ready status.
日本語の概要は準備中です。原文の説明を表示しています。
Independent control layer for security-research agents — prevent unsafe actions, unsupported claims, scope violations, evidence contamination, target impact, and premature reporting.
日本語の概要は準備中です。原文の説明を表示しています。
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
日本語の概要は準備中です。原文の説明を表示しています。
Provide systematic methodologies for leveraging Shodan as a reconnaissance tool during penetration testing engagements.
日本語の概要は準備中です。原文の説明を表示しています。
Audit smart contracts for security vulnerabilities. Use when user says "audit", "review this contract", "find bugs", "bounty", "security review", or points at a repo/program for vulnerability assessment. Covers Anchor/Solana, EVM/Solidity, and general patterns. Includes content-compression workarounds.
日本語の概要は準備中です。原文の説明を表示しています。
Master smart contract security best practices, vulnerability prevention, and secure Solidity development patterns.
日本語の概要は準備中です。原文の説明を表示しています。