Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Complete reference for 25 web2 bug classes with root causes, detection patterns, bypass tables, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC (PKCE, state, alg confusion, OIDC discovery-document misconfig, Spring x-application-context leak, .env/404 differential, Kong gateway version disclosure, actuator index footprint), file upload (10 bypasses), GraphQL, LLM/AI (ASI01-ASI10 + MCP/RAG/vector poisoning), API misconfig (mass assignment, JWT attacks, prototype pollution, CORS), ATO taxonomy, SSTI, subdomain takeover, cloud/infra, HTTP smuggling, cache poisoning, MFA bypass (7 patterns), SAML attacks, error disclosure/debug endpoints, CSS injection, LFI->RCE (filter chain RCE, log poisoning, polyglot .user.ini), insecure deserialization (PHP phar, Java ysoserial, Python pickle, Node node-serialize). Use when hunting a specific vuln class or studying what makes bugs pay.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Smart contract security audit — 11 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy, BFT/consensus/liveness), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Drive a **locally-running open-kritt stack** (github.com/Kritt-ai/open-kritt) from Hermes for bug-bounty code audits. open-kritt is a self-hosted Docker platform that orchestrates AI agents (Codex / Claude Code) to find real vulnerabilities in a target repo, de-duplicates, and severity-ranks the findings. Use this skill when the user asks to scan/audit a GitHub repo or a local codebase with kritt, wants AI-driven vulnerability discovery on a Solidity/ Rust/JS/Go project, or references "open-kritt" / "kritt scan". The skill talks to the kritt backend REST API at http://127.0.0.1:3002/api (override with KRITT_BACKEND_URL), so the Docker stack must be running first (`./kritt start` in the cloned repo). Capabilities: list workflows / post-scripts / local repos, launch a scan against a remote GitHub repo or a registered local folder, poll until complete, and pull ranked findings. Findings feed naturally into the bug-bounty / web3-audit workflows for PoC + reporting.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Provide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Comprehensive techniques for capturing, analyzing, and documenting network protocols for security research, interoperability, and debugging.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Implement proven methodologies and tool workflows from top security researchers for effective reconnaissance, vulnerability discovery, and bug bounty hunting. Automate common tasks while maintaining thorough coverage of attack surfaces.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Expert reverse engineer specializing in binary analysis, disassembly, decompilation, and software analysis. Masters IDA Pro, Ghidra, radare2, x64dbg, and modern RE toolchains.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Determine the minimal technical root cause of candidate security findings, separate causes from symptoms, cluster duplicates, and identify shared vulnerable abstractions.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Smart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan, signature replay, and MEV-related attack patterns.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Secret Scanner - Auto-activating skill for Security Fundamentals. Triggers on: secret scanner, secret scanner Part of the Security Fundamentals skill category.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Adversarial security finding triage — decide whether a candidate finding is real, reachable, exploitable, and in-scope by actively trying to falsify it before it reaches report-ready status.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Independent control layer for security-research agents — prevent unsafe actions, unsupported claims, scope violations, evidence contamination, target impact, and premature reporting.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Provide systematic methodologies for leveraging Shodan as a reconnaissance tool during penetration testing engagements.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Audit smart contracts for security vulnerabilities. Use when user says "audit", "review this contract", "find bugs", "bounty", "security review", or points at a repo/program for vulnerability assessment. Covers Anchor/Solana, EVM/Solidity, and general patterns. Includes content-compression workarounds.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Master smart contract security best practices, vulnerability prevention, and secure Solidity development patterns.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.