Skip to content
cccskills
FreePublished on GitHub

disclosure

Drive responsible disclosure of a proven finding to a CVE. Package the report, find the vendor contact, report privately, coordinate a timeline, request the CVE (vendor CNA / GitHub / MITRE), and publish an advisory. Closes the research loop. Triggers - "disclose", "request a cve", "report this to the vendor".

The English summary is being prepared. Showing the original description.

Encod3d-Sec/TORCH
Works withGitHub
See how to install

Files included (1)

  • SKILL.md2.7 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Disclosure: Finding -> CVE

Turn a proven, novel vulnerability into a coordinated disclosure and a published CVE. Pairs with the research skill (a finding in findings.md) or an engagement FIND. Read [[responsible-disclosure]] first.

Gate (READ FIRST)

  • The finding must be proven + reproducible (minimal PoC, affected versions, impact) and novelty-checked (not an existing CVE). If not, go back to the research skill.
  • Confirm you are authorised / in safe-harbor for the target. No authorization -> do not proceed (CFAA / Computer Misuse Act). Research on public software you can lawfully analyze is fine; testing live third-party systems needs permission.

Procedure

  1. Package the report from the finding: title, affected + fixed/tested versions, CWE class, CVSS vector + score, clear repro steps, minimal PoC, impact, suggested remediation, your contact. Redact any real data.
  2. Find the contact (in order): /.well-known/security.txt, SECURITY.md, security@<vendor>, vendor PSIRT, a bug-bounty platform if they run one, GitHub private vulnerability reporting for OSS, else CERT/CC.
  3. Report privately over that channel; PGP-encrypt if a key is published. Professional, specific, non-extortive. Offer to validate the fix.
  4. Coordinate a timeline - propose ~90 days; track it; escalate to CERT/CC if the vendor goes dark past the deadline.
  5. Request the CVE: vendor CNA assigns it; for OSS open a GitHub Security Advisory (GitHub issues the CVE); otherwise MITRE CVE request form (CNA of last resort). Supply product, versions, CWE, impact, reference.
  6. Publish the advisory after fix/deadline: CVE ID, affected/fixed versions, CWE, CVSS, description, PoC, impact, remediation, timeline, credit. Mirror to the researcher's blog/GitHub for the portfolio.

Output

  • A ready-to-send disclosure report (draft) and a public advisory (draft) saved under the project: raw/research/<project>/advisory.md (and the contact + timeline tracked in findings.md).
  • Update the finding status: candidate -> reported -> CVE-<id> -> published.

Wiki feedback

Reusable disclosure lesson (vendor process quirk, CNA tip) -> update [[responsible-disclosure]]. The vuln technique itself -> the matching wiki/techniques/ page via research-ingest.

Report: report + advisory drafts, contact channel, and the disclosure timeline.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

arsenal

Free

Wiki-first "what do I use" lookup - pick the automated TOOL (wiki/tools/), then the PAYLOAD/technique (wiki/payloads/ + wiki/cheatsheets/), for a surface/service/vuln-class BEFORE hand-rolling or working from memory. Use for "tool for <service>", "automated tools for web/<service>", "what should I run on <surface>", "which tool for <X>", "payloads for <X>", "payload arsenal", "cheatsheet for <X>", "how do I exploit <tech/class>", "exploit/attack chain for <X>", "arsenal", any SSRF/XSS/SQLi/SSTI/LFI/JWT/XXE/IDOR/NoSQL/deserialization/CSRF/CORS/CRLF/GraphQL/smuggling/web-cache/OAuth/SAML/MFA/crypto/LDAP/XPath/WebAuthn/file-upload/IMDS/prompt-injection/Modbus ask, plus "privesc arsenal", "CVE arsenal", "default creds", "nuclei templates", "sqlmap/hydra/nmap/bloodhound", "password attacks".

The English summary is being prepared. Showing the original description.

Encod3d-Sec/TORCH333Updated Sep 1, 2026

bb-workflow

Free

Autonomous bug-bounty campaign driver. Runs a full programme end to end with no operator approvals - the deterministic driver (scripts/campaign.py) owns pass state, generates the killchain board from recon, and prints the exact next action (including which Skill and tool to run) every turn. Use when starting or resuming a bug-bounty engagement, "run the bb workflow", "hunt this program", "9-pass campaign", or when handed a *.scope wildcard to test for TIER1 findings. Single agent, refuter-verified, wiki-first, tool-first.

The English summary is being prepared. Showing the original description.

Encod3d-Sec/TORCH333Updated Sep 1, 2026

campaign-health

Free

Health check for the bb/pt/ctf workflow driver subsystem - verifies everything is in place so every machine runs the same. Checks vault-content consistency (scripts present, JSON valid, routing wired, all 69 tool pages carry phase:, the tool index resolves, the hook edits are in place) AND per-machine wiring (the three workflow skills symlinked, hooks registered, imports work), then runs a live init->board->next smoke test. Use when setting up the workflow on a new machine, after a vault sync, when the driver misbehaves, or on "bb-health", "campaign health", "is the workflow set up", "check hooks and scripts", "why is the board not working".

The English summary is being prepared. Showing the original description.

Encod3d-Sec/TORCH333Updated Sep 1, 2026

chrome-devtools-browser

Free

Bring up a REAL, visible, interactive chromium on the Kali VM that the operator logs into (Smart-ID / Mobile-ID / any manual auth or MFA/CAPTCHA), while the agent drives and observes it live through the chrome-devtools MCP (navigate, DOM snapshot, network capture, screenshots, console, evaluate). Use whenever a target needs a MANUAL login the agent cannot complete headlessly, when you need to capture an authenticated session / the real API calls a page makes, or to confirm/screenshot a DOM-XSS. Triggers - "open a browser", "log in manually", "smart-id / mobile-id / national id login", "mfa / 2fa login", "solve the captcha", "drive the browser", "capture the authenticated session / network".

The English summary is being prepared. Showing the original description.

Encod3d-Sec/TORCH333Updated Sep 1, 2026

claude-md-improver

Free

OFFLINE FALLBACK for the claude-md-management plugin - prefer that plugin when it is installed. Audit and improve CLAUDE.md files - scan for CLAUDE.md files, evaluate quality against templates, output a report, then make targeted updates. Invoke explicitly (/claude-md-improver) when the plugin is unavailable.

The English summary is being prepared. Showing the original description.

Encod3d-Sec/TORCH333Updated Sep 1, 2026

coverage

Free

Show per-asset vuln-class coverage gaps for the active engagement so nothing in scope is skipped. Use when asked "coverage", "what haven't we tested", "test gaps", "are we thorough", or before calling an engagement done.

The English summary is being prepared. Showing the original description.

Encod3d-Sec/TORCH333Updated Sep 1, 2026

See all skills by Encod3d-Sec

Report a problem with this skill