Run any Skill in Manus with one click

report-search

Stars103

Forks31

UpdatedJune 26, 2026 at 19:51

Search the local corpus of ~10k disclosed HackerOne bug bounty reports by vulnerability class, technique, program, or keyword. Use when the user wants precedent / prior art for a vuln type, asks "how was X exploited", wants examples of a bug class, or any other skill needs to ground itself in real disclosed reports. Returns ranked matches with report IDs, severity, program handle, and excerpts.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

bugbountywithmarco

bugbountywithmarco/bugbounty-disclosed-reports

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Computer Occupations, All OtherComputer and Mathematical Occupations·SOC 15-1299

SKILL.md

readonly

name	report-search
description	Search the local corpus of ~10k disclosed HackerOne bug bounty reports by vulnerability class, technique, program, or keyword. Use when the user wants precedent / prior art for a vuln type, asks "how was X exploited", wants examples of a bug class, or any other skill needs to ground itself in real disclosed reports. Returns ranked matches with report IDs, severity, program handle, and excerpts.

report-search

Search the disclosed-report corpus in reports/ (one Markdown file per HackerOne report, format: title, Report Details, Reporter, Team/Handle, Vulnerability Information / Summary / Steps To Reproduce / Impact).

This is the foundation skill — other bug-bounty skills call the same search helper.

How to search

Use the shared helper. Always run it from the repo root:

python3 .claude/skills/_lib/search_reports.py "<query terms>" [options]

Options:

--severity critical,high — filter by severity (critical/high/medium/low/none)
--handle shopify — filter by program handle (substring match)
--limit 20 — max results (default 20)
--full — include a body excerpt for each hit (read precedent without extra Reads)
--titles-only — match only titles/filenames (high-precision, less recall)

Scoring weighs title/filename matches above body matches, rewards covering more distinct query terms, and bonuses verbatim phrase hits.

Workflow

Run a broad query first (e.g. "cache deception", "oauth account takeover").
If too many/noisy results, add --titles-only or a --handle / --severity filter. If too few, drop filters or use broader synonyms.
Pick the most relevant 3–8 reports and Read their full files for technique detail, or pass --full to skim excerpts inline.
Synthesize: report the patterns, link each claim to a specific reports/<file> and #<id> (https://hackerone.com/reports/<id>) so the user can verify.

Tips

Vuln-class synonyms matter: try both ssrf and server side request forgery, idor and insecure direct object, ato and account takeover.
The corpus skews toward RCE, XSS, bypasses, CSRF, memory-safety, cache, SQLi, SSRF, IDOR, account-takeover, info-disclosure, rate-limit, subdomain-takeover.
Always cite report IDs. Never invent a report that search didn't return.

More from this repository

same repository

hunt

bugbountywithmarco/bugbounty-disclosed-reports

Hunt a target codebase or web app for a specific vulnerability class, primed with real exploitation patterns from the local disclosed-report corpus. Use when the user wants to find real vulnerabilities — "look for IDOR/SSRF/XSS/auth bypass in this code", "audit this for <vuln class>", "find bugs in <target>". Combines corpus-derived patterns with source/endpoint analysis and reports concrete candidate findings.

2026-06-26103

poc

bugbountywithmarco/bugbounty-disclosed-reports

Build a proof-of-concept / reproduction steps for a candidate finding — HTTP requests (curl/Burp), payloads, or a small script — modeled on the "Steps To Reproduce" sections of the local disclosed-report corpus. Use when the user wants to confirm or demonstrate a bug, "build a PoC", "give me the curl/requests to reproduce", or "write a script to exploit this".

2026-06-26103

program-intel

bugbountywithmarco/bugbounty-disclosed-reports

Summarize the historical bug patterns for a specific bug bounty program/team using the local disclosed-report corpus. Use when the user names a program (e.g. shopify, gitlab, nextcloud, nodejs, uber, tiktok) and wants to know what's been found there, recurring weak spots, hot endpoints/assets, and what to avoid duplicating. Helps focus hunting and avoid dupes.

2026-06-26103

recon-playbook

bugbountywithmarco/bugbounty-disclosed-reports

Build a hunting checklist / methodology for a vulnerability class or target tech stack, distilled from the local disclosed-report corpus. Use when the user asks "how do I hunt for X", "give me a methodology / checklist for X", "what should I test on a <tech> target", or wants a recon plan grounded in real disclosed bugs (e.g. SSRF, IDOR, rate-limit, cache deception, subdomain takeover, OAuth).

2026-06-26103

severity

bugbountywithmarco/bugbounty-disclosed-reports

Estimate the severity of a vulnerability finding and produce a CVSS 3.1 vector + impact framing, calibrated against how similar findings were rated in the local disclosed-report corpus. Use when the user asks "how severe is this", "what CVSS score", "how should I rate this", or needs an impact statement for a report.

2026-06-26103

write-report

bugbountywithmarco/bugbounty-disclosed-reports

Write a disclosure-quality bug bounty report for a finding, matching the HackerOne report format used in this repo's corpus. Use when the user has a vulnerability and wants it written up — "write a report for this", "draft a HackerOne submission", "turn this finding into a report". Produces title, summary, steps to reproduce, impact, severity, and remediation, few-shot styled on real disclosed reports.

2026-06-26103

name	report-search
description	Search the local corpus of ~10k disclosed HackerOne bug bounty reports by vulnerability class, technique, program, or keyword. Use when the user wants precedent / prior art for a vuln type, asks "how was X exploited", wants examples of a bug class, or any other skill needs to ground itself in real disclosed reports. Returns ranked matches with report IDs, severity, program handle, and excerpts.

report-search

This is the foundation skill — other bug-bounty skills call the same search helper.

How to search

Use the shared helper. Always run it from the repo root:

python3 .claude/skills/_lib/search_reports.py "<query terms>" [options]

Options:

--severity critical,high — filter by severity (critical/high/medium/low/none)
--handle shopify — filter by program handle (substring match)
--limit 20 — max results (default 20)
--full — include a body excerpt for each hit (read precedent without extra Reads)
--titles-only — match only titles/filenames (high-precision, less recall)

Scoring weighs title/filename matches above body matches, rewards covering more distinct query terms, and bonuses verbatim phrase hits.

Workflow

Run a broad query first (e.g. "cache deception", "oauth account takeover").
If too many/noisy results, add --titles-only or a --handle / --severity filter. If too few, drop filters or use broader synonyms.
Pick the most relevant 3–8 reports and Read their full files for technique detail, or pass --full to skim excerpts inline.
Synthesize: report the patterns, link each claim to a specific reports/<file> and #<id> (https://hackerone.com/reports/<id>) so the user can verify.

Tips

Vuln-class synonyms matter: try both ssrf and server side request forgery, idor and insecure direct object, ato and account takeover.
The corpus skews toward RCE, XSS, bypasses, CSRF, memory-safety, cache, SQLi, SSRF, IDOR, account-takeover, info-disclosure, rate-limit, subdomain-takeover.
Always cite report IDs. Never invent a report that search didn't return.