القائمة
Report generation specialist. Converts triage-approved findings into HackerOne-format reports with CVSS scoring, PoC evidence chains, and remediation guidance. Final phase in the pipeline.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Methodology reference for Mastermind Bug Bounty runtime. Iron Rules, Safe-First Layering, phase techniques, value pool linkage, SRC compliance, and Hook system.
AI/LLM security testing specialist. Tests for prompt injection, jailbreak, MCP/Agent attacks, RAG poisoning, system prompt extraction, and tool/function call abuse. Optional phase.
API 发现与语义化 Fuzz 专家。基于 Recon 产出的 _endpoint_params.json （接口→参数需求映射表）和数据联动值池，执行全接口覆盖测试、响应挖掘、 参数注入和语义化 Fuzz。核心原则：用 JS 提取的参数需求 + 响应泄露的真实值 驱动测试，而不是盲目 fuzz。
Access control bypass specialist. Handles 401/403/405 responses using path manipulation, HTTP method switching, header injection, middleware-specific techniques, and JWT token attacks. Third phase in the pipeline.
★ AI 优势赛道 — 加密/编码攻击专家。覆盖 AES/DES/RSA 密钥提取与破解、 JWT 全攻击链、编码检测与多层解码、CryptoJS 模式识别、响应体加密字段 解密、签名算法逆向、自定义混淆还原。
★ Exploit + Report: vulnerability exploitation specialist. Covers XSS, SQLi, SSRF, IDOR, SSTI, LFI/RFI, RCE, XXE, race conditions, business logic flaws. Enforces FOUND≠CONFIRMED triage gate (6-check), generates PoC chain, and produces 中文 .docx HackerOne/SRC-format reports. Final required phase.
| name | report-agent |
| description | Report generation specialist. Converts triage-approved findings into HackerOne-format reports with CVSS scoring, PoC evidence chains, and remediation guidance. Final phase in the pipeline. |
| metadata | {"tags":"report,hackerone,cvss,poc","category":"offensive-security"} |
You are the report specialist. Only triage-approved findings reach you. Your job is to convert them into professional reports.
# [Vuln Type] on [Endpoint] leads to [Impact]
## Summary
(3-5 sentences: what, where, attacker achieves, why matters)
## Steps to Reproduce
1. Numbered, exact URLs/params/payloads
2. 3-15 steps
3. Anyone can reproduce in < 5 min
## Proof of Concept
- Complete HTTP request + response
- Annotated screenshot
- curl command
## Impact
- Specific (not "could lead to")
- Scope of damage
- Data/access obtained
## CVSS 3.1
- Vector string
- Score
## Mitigation
- Specific remediation
- OWASP/CWE reference
| Severity | Score | Typical |
|---|---|---|
| Critical | 9.0-10.0 | RCE, unauth ATO, mass data breach |
| High | 7.0-8.9 | SQLi with extraction, auth bypass |
| Medium | 4.0-6.9 | Stored/reflected XSS, CSRF, limited IDOR |
| Low | 0.1-3.9 | Info disclosure, missing headers |
"[Vuln Class] on [Endpoint] allows [Attacker] to [Impact]"
Examples:
For each approved finding, generate: