본문으로 건너뛰기
cccskills
무료GitHub에 공개

bug-bounty-disclosure

Skill end-to-end buat authorized/good-faith bug bounty & coordinated vulnerability disclosure ke developer atau pemilik projek — untuk SEMUA jenis bug (web, API, infra, mobile, cloud, smart contract/web3, agent/LLM), crypto maupun non-crypto. Pakai skill ini setiap kali user mau triase & verifikasi temuan, bikin PoC, NYARI kontak dev/owner (security.txt, SECURITY.md, GitHub, WHOIS, on-chain, sosmed), dan KIRIM laporan via email — baik target punya program bug bounty terdaftar (HackerOne/Immunefi/dll) maupun proyek tanpa program resmi. Trigger juga kalau user nyebut "report bug ke dev", "disclosure", "lapor kerentanan", "cari kontak owner projek", "kirim report email", "responsible disclosure", "bug bounty" — walau ga eksplisit bilang "skill". Sisi disclosure jalan buat proyek apapun; dasar pengetesan harus sah/good-faith.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic스타 92(GitHub 92 + cccskills 0)
연동 도구GitHub

실행 점수 미검증

설치 방법 보기

포함된 파일(6)

  • SKILL.md3.9 KB
  • bug-bounty-disclosure.skill10.3 KB
  • references/contact-discovery.md3.4 KB
  • references/report-templates.md3.6 KB
  • references/vuln-classes.md3.5 KB
  • workflow.md4.1 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Bug Bounty & Coordinated Disclosure

Skill buat ngerapihin seluruh alur dari temuan → verifikasi → cari kontak → lapor ke dev via email → koordinasi fix. Serba-guna: crypto & non-crypto, target dengan program resmi maupun tanpa program. Fokusnya bikin laporan yang valid, reproducible, dan diterima dev — bukan AI-slop yang di-ignore.

⚠️ Dasar good-faith (baca dulu, singkat)

Skill ini buat good-faith security research + coordinated disclosure. Lapor kerentanan ke pemilik projek itu sah & etis entah mereka punya program resmi atau enggak — justru itu tujuannya.

Yang harus dijaga: dasar pengetesan harus sah. Bug ditemukan lewat cara legit:

  • Sistem/infra milik sendiri, akun sendiri, atau testnet.
  • Review kode open-source / artefak publik (repo, package, image).
  • Analisis smart contract on-chain (bytecode/source publik).
  • Target yang punya program bug bounty / VDP / security.txt yang mengundang laporan.
  • Ada izin tertulis dari owner.

Jangan pakai skill ini buat membenarkan intrusi tanpa izin ke sistem produksi pihak ketiga (mancing kredensial, nembus akses yang bukan hak lo, lanjut nge-drill setelah dapat akses). Kalau ragu apakah suatu langkah pengetesan sah: stop, jangan eskalasi akses, laporkan hanya yang lo temukan lewat cara legit. Untuk bug crypto yang dananya live & exploitable: jangan exploit, jangan publikasikan dulu — disclosure privat ke tim adalah langkah yang benar.

Prinsip inti

Sebuah temuan layak dikirim ke dev kalau: (1) valid & reproducible dengan PoC, (2) impact-nya nyata, (3) dikirim ke pihak yang benar lewat kanal yang tepat, dengan (4) nada good-faith, tanpa ancaman/ransom.

Alur pakai skill

  1. Jalanin workflow.md — pipeline 6 fase: Triase → Verifikasi/PoC → Impact → Cari Kontak → Kirim Email → Koordinasi & Follow-up.
  2. Fase Cari Kontak → buka references/contact-discovery.md (metode nyari dev/owner, crypto & non-crypto, + verifikasi pihak & enkripsi).
  3. Fase Kirim Email → buka references/report-templates.md (template email disclosure + laporan teknis, ID/EN).
  4. Butuh klasifikasi bug (fase Triase/Impact) → references/vuln-classes.md (recognition cepat: web/API/infra/cloud, smart contract/web3, agent/LLM info-flow).

Aturan anti-slop (non-negotiable)

  1. No PoC, no report. Tiap klaim reproducible dengan bukti (log/screenshot/tx hash).
  2. Impact ditunjukin, bukan diklaim. Demokan minimal & non-destruktif; jangan bikin kerusakan buat "ngebuktiin".
  3. Ulang ≥3×, isolasi variabel, minimize payload/PoC.
  4. Ga bisa reproduce → buang. Jangan overclaim severity, jangan filler.
  5. Satu report = satu bug yang jelas. Jangan gabung 10 "temuan" variasi teks.
  6. Kirim ke pihak & kanal yang benar. Verifikasi dulu, pakai kanal security khusus, enkripsi detail sensitif.

Output

Deliverable: temuan tervalidasi → kontak dev/owner terverifikasi → email disclosure + laporan teknis (bahasa ngikutin target, ID/EN, nada natural & teknis) → catatan koordinasi/timeline.

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

api-fuzzing-bug-bounty

무료

Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic922026년 8월 27일 업데이트

attack-chain-web2

무료

Web2 attack chain plugin — apply Web2 trust boundaries and composition rules on top of attack-chaining-core for authorized testing of web apps, APIs, identity, cloud, and internal services.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic922026년 8월 27일 업데이트

attack-chain-web3

무료

Web3 attack chain plugin — apply Web3 state, economic, cryptographic, and consensus semantics on top of attack-chaining-core for authorized testing of smart contracts, DeFi, bridges, wallets, and validators.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic922026년 8월 27일 업데이트

attack-chaining-core

무료

Domain-neutral attack chain analysis — determine whether independently identified security primitives compose into a realistic, authorized, evidence-backed attack path with greater impact.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic922026년 8월 27일 업데이트

attack-surface-mapper

무료

Build an evidence-backed map of externally and internally reachable attack surfaces, trust boundaries, privileged transitions, security assets, and high-value audit targets before vulnerability hunting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic922026년 8월 27일 업데이트

bb-methodology

무료

Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If experiments). Routes to all other skills based on current hunting phase. Also use when asking "what should I do next" or "where am I in the process."

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sekolah76/syadagentic922026년 8월 27일 업데이트

Sekolah76의 스킬 모두 보기

이 스킬의 문제 신고