Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
classLegalConsiderations:
"""Legal framework for security research."""
SAFE_HARBOR_POLICIES = {
"US": {
"primary_law": "Computer Fraud and Abuse Act (CFAA)",
"safe_harbor": [
"Bug bounty program terms",
"DOJ Policy for Good Faith Research (2022)",
"Authorized testing agreements"
],
"risks": [
"CFAA prosecution if unauthorized",
"Civil liability possible"
],
"recommendations": [
"Stay within program scope",
"Document authorization",
"Consult lawyer if uncertain"
]
},
"EU": {
"primary_law": "Various national laws",
"safe_harbor": [
"Coordinated disclosure frameworks",
"NIS2 Directive provisions"
],
"considerations": [
"GDPR for any data accessed",
"National cybercrime laws vary"
]
},
"UK": {
"primary_law": "Computer Misuse Act 1990",
"safe_harbor": [
"CMA prosecution guidance",
"Good faith research guidance"
],
"recommendations": [
"Follow NCSC guidance",
"Use authorized programs"
]
}
}
@staticmethoddefassess_legal_risk(jurisdiction: str, research_type: str) -> LegalAssessment:
"""Assess legal risk for security research."""
framework = LegalConsiderations.SAFE_HARBOR_POLICIES.get(jurisdiction)
return LegalAssessment(
jurisdiction=jurisdiction,
safe_harbor_available=bool(framework.get("safe_harbor")),
recommendations=framework.get("recommendations", []),
risks=framework.get("risks", []),
advice="Always seek legal counsel for novel research"
)
Communication Templates
Initial Contact
Subject: Security Vulnerability Report - [Product Name]
Dear Security Team,
I am a security researcher and I have discovered a vulnerability in
[Product Name] that I would like to report through coordinated disclosure.
**Summary:**- Type: [Vulnerability Type]
- Severity: [Critical/High/Medium/Low]
- Impact: [Brief impact description]
I am committed to working with you to ensure this issue is resolved
before any public disclosure. My suggested timeline is [X] days,
but I am flexible based on the complexity of the fix.
I have attached a detailed report with reproduction steps. Please
confirm receipt and let me know the best way to proceed.
I am available via encrypted email (PGP key attached) or through
[HackerOne/Bugcrowd/Signal].
Best regards,
[Your Name]
[Contact Information]
[PGP Fingerprint]
Follow-up (No Response)
Subject: Follow-up: Security Vulnerability Report - [Product Name]
Dear Security Team,
I am following up on my vulnerability report sent on [Date].
I have not received acknowledgment and want to ensure the
report was received.
The vulnerability is [severity level] and affects [scope].
I remain committed to coordinated disclosure but need to
establish communication.
If you are not the correct contact, please forward this to
the appropriate team or provide an alternative contact.
Timeline: [X] days remaining before disclosure deadline.
Best regards,
[Your Name]
Severity Assessment
AI-Specific Severity Guidelines:CRITICAL:examples:-"Complete safety bypass enabling harmful content at scale"-"Training data extraction with PII"-"Remote code execution via model"-"Authentication bypass to model"cvss_range:"9.0-10.0"disclosure_timeline:"45-60 days"HIGH:examples:-"Consistent jailbreak bypass"-"System prompt extraction"-"Significant model theft risk"-"Privilege escalation in agents"cvss_range:"7.0-8.9"disclosure_timeline:"60-90 days"MEDIUM:examples:-"Partial information disclosure"-"Rate limiting bypass"-"Inconsistent safety bypass"-"Minor model manipulation"cvss_range:"4.0-6.9"disclosure_timeline:"90-120 days"LOW:examples:-"Verbose error messages"-"Minor configuration issues"-"Theoretical attacks only"cvss_range:"0.1-3.9"disclosure_timeline:"120+ days"
