Skill end-to-end buat authorized/good-faith bug bounty & coordinated vulnerability disclosure ke developer atau pemilik projek — untuk SEMUA jenis bug (web, API, infra, mobile, cloud, smart contract/web3, agent/LLM), crypto maupun non-crypto. Pakai skill ini setiap kali user mau triase & verifikasi temuan, bikin PoC, NYARI kontak dev/owner (security.txt, SECURITY.md, GitHub, WHOIS, on-chain, sosmed), dan KIRIM laporan via email — baik target punya program bug bounty terdaftar (HackerOne/Immunefi/dll) maupun proyek tanpa program resmi. Trigger juga kalau user nyebut "report bug ke dev", "disclosure", "lapor kerentanan", "cari kontak owner projek", "kirim report email", "responsible disclosure", "bug bounty" — walau ga eksplisit bilang "skill". Sisi disclosure jalan buat proyek apapun; dasar pengetesan harus sah/good-faith.
The English summary is being prepared. Showing the original description.
Run score Not tested
See how to installReview the instructions the agent will receive before you install.
Skill buat ngerapihin seluruh alur dari temuan → verifikasi → cari kontak → lapor ke dev via email → koordinasi fix. Serba-guna: crypto & non-crypto, target dengan program resmi maupun tanpa program. Fokusnya bikin laporan yang valid, reproducible, dan diterima dev — bukan AI-slop yang di-ignore.
Skill ini buat good-faith security research + coordinated disclosure. Lapor kerentanan ke pemilik projek itu sah & etis entah mereka punya program resmi atau enggak — justru itu tujuannya.
Yang harus dijaga: dasar pengetesan harus sah. Bug ditemukan lewat cara legit:
security.txt yang mengundang laporan.Jangan pakai skill ini buat membenarkan intrusi tanpa izin ke sistem produksi pihak ketiga (mancing kredensial, nembus akses yang bukan hak lo, lanjut nge-drill setelah dapat akses). Kalau ragu apakah suatu langkah pengetesan sah: stop, jangan eskalasi akses, laporkan hanya yang lo temukan lewat cara legit. Untuk bug crypto yang dananya live & exploitable: jangan exploit, jangan publikasikan dulu — disclosure privat ke tim adalah langkah yang benar.
Sebuah temuan layak dikirim ke dev kalau: (1) valid & reproducible dengan PoC, (2) impact-nya nyata, (3) dikirim ke pihak yang benar lewat kanal yang tepat, dengan (4) nada good-faith, tanpa ancaman/ransom.
workflow.md — pipeline 6 fase: Triase → Verifikasi/PoC → Impact → Cari Kontak → Kirim Email → Koordinasi & Follow-up.references/contact-discovery.md (metode nyari dev/owner, crypto & non-crypto, + verifikasi pihak & enkripsi).references/report-templates.md (template email disclosure + laporan teknis, ID/EN).references/vuln-classes.md (recognition cepat: web/API/infra/cloud, smart contract/web3, agent/LLM info-flow).Deliverable: temuan tervalidasi → kontak dev/owner terverifikasi → email disclosure + laporan teknis (bahasa ngikutin target, ID/EN, nada natural & teknis) → catatan koordinasi/timeline.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
The English summary is being prepared. Showing the original description.
Web2 attack chain plugin — apply Web2 trust boundaries and composition rules on top of attack-chaining-core for authorized testing of web apps, APIs, identity, cloud, and internal services.
The English summary is being prepared. Showing the original description.
Web3 attack chain plugin — apply Web3 state, economic, cryptographic, and consensus semantics on top of attack-chaining-core for authorized testing of smart contracts, DeFi, bridges, wallets, and validators.
The English summary is being prepared. Showing the original description.
Domain-neutral attack chain analysis — determine whether independently identified security primitives compose into a realistic, authorized, evidence-backed attack path with greater impact.
The English summary is being prepared. Showing the original description.
Build an evidence-backed map of externally and internally reachable attack surfaces, trust boundaries, privileged transitions, security assets, and high-value audit targets before vulnerability hunting.
The English summary is being prepared. Showing the original description.
Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If experiments). Routes to all other skills based on current hunting phase. Also use when asking "what should I do next" or "where am I in the process."
The English summary is being prepared. Showing the original description.