Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

report-search

Estrellas103

Forks31

Actualizado26 de junio de 2026 a las 19:51

Search the local corpus of ~10k disclosed HackerOne bug bounty reports by vulnerability class, technique, program, or keyword. Use when the user wants precedent / prior art for a vuln type, asks "how was X exploited", wants examples of a bug class, or any other skill needs to ground itself in real disclosed reports. Returns ranked matches with report IDs, severity, program handle, and excerpts.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

bugbountywithmarco

bugbountywithmarco/bugbounty-disclosed-reports

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Otras ocupaciones informáticasOcupaciones informáticas y matemáticas·SOC 15-1299

SKILL.md

readonly

name	report-search
description	Search the local corpus of ~10k disclosed HackerOne bug bounty reports by vulnerability class, technique, program, or keyword. Use when the user wants precedent / prior art for a vuln type, asks "how was X exploited", wants examples of a bug class, or any other skill needs to ground itself in real disclosed reports. Returns ranked matches with report IDs, severity, program handle, and excerpts.

report-search

Search the disclosed-report corpus in reports/ (one Markdown file per HackerOne report, format: title, Report Details, Reporter, Team/Handle, Vulnerability Information / Summary / Steps To Reproduce / Impact).

This is the foundation skill — other bug-bounty skills call the same search helper.

How to search

Use the shared helper. Always run it from the repo root:

python3 .claude/skills/_lib/search_reports.py "<query terms>" [options]

Options:

--severity critical,high — filter by severity (critical/high/medium/low/none)
--handle shopify — filter by program handle (substring match)
--limit 20 — max results (default 20)
--full — include a body excerpt for each hit (read precedent without extra Reads)
--titles-only — match only titles/filenames (high-precision, less recall)

Scoring weighs title/filename matches above body matches, rewards covering more distinct query terms, and bonuses verbatim phrase hits.

Workflow

Run a broad query first (e.g. "cache deception", "oauth account takeover").
If too many/noisy results, add --titles-only or a --handle / --severity filter. If too few, drop filters or use broader synonyms.
Pick the most relevant 3–8 reports and Read their full files for technique detail, or pass --full to skim excerpts inline.
Synthesize: report the patterns, link each claim to a specific reports/<file> and #<id> (https://hackerone.com/reports/<id>) so the user can verify.

Tips

Vuln-class synonyms matter: try both ssrf and server side request forgery, idor and insecure direct object, ato and account takeover.
The corpus skews toward RCE, XSS, bypasses, CSRF, memory-safety, cache, SQLi, SSRF, IDOR, account-takeover, info-disclosure, rate-limit, subdomain-takeover.
Always cite report IDs. Never invent a report that search didn't return.

Más de este repositorio

mismo repositorio

hunt

bugbountywithmarco/bugbounty-disclosed-reports

Hunt a target codebase or web app for a specific vulnerability class, primed with real exploitation patterns from the local disclosed-report corpus. Use when the user wants to find real vulnerabilities — "look for IDOR/SSRF/XSS/auth bypass in this code", "audit this for <vuln class>", "find bugs in <target>". Combines corpus-derived patterns with source/endpoint analysis and reports concrete candidate findings.

2026-06-26103

poc

bugbountywithmarco/bugbounty-disclosed-reports

Build a proof-of-concept / reproduction steps for a candidate finding — HTTP requests (curl/Burp), payloads, or a small script — modeled on the "Steps To Reproduce" sections of the local disclosed-report corpus. Use when the user wants to confirm or demonstrate a bug, "build a PoC", "give me the curl/requests to reproduce", or "write a script to exploit this".

2026-06-26103

program-intel

bugbountywithmarco/bugbounty-disclosed-reports

Summarize the historical bug patterns for a specific bug bounty program/team using the local disclosed-report corpus. Use when the user names a program (e.g. shopify, gitlab, nextcloud, nodejs, uber, tiktok) and wants to know what's been found there, recurring weak spots, hot endpoints/assets, and what to avoid duplicating. Helps focus hunting and avoid dupes.

2026-06-26103

recon-playbook

bugbountywithmarco/bugbounty-disclosed-reports

Build a hunting checklist / methodology for a vulnerability class or target tech stack, distilled from the local disclosed-report corpus. Use when the user asks "how do I hunt for X", "give me a methodology / checklist for X", "what should I test on a <tech> target", or wants a recon plan grounded in real disclosed bugs (e.g. SSRF, IDOR, rate-limit, cache deception, subdomain takeover, OAuth).

2026-06-26103

severity

bugbountywithmarco/bugbounty-disclosed-reports

Estimate the severity of a vulnerability finding and produce a CVSS 3.1 vector + impact framing, calibrated against how similar findings were rated in the local disclosed-report corpus. Use when the user asks "how severe is this", "what CVSS score", "how should I rate this", or needs an impact statement for a report.

2026-06-26103

write-report

bugbountywithmarco/bugbounty-disclosed-reports

Write a disclosure-quality bug bounty report for a finding, matching the HackerOne report format used in this repo's corpus. Use when the user has a vulnerability and wants it written up — "write a report for this", "draft a HackerOne submission", "turn this finding into a report". Produces title, summary, steps to reproduce, impact, severity, and remediation, few-shot styled on real disclosed reports.

2026-06-26103

name	report-search
description	Search the local corpus of ~10k disclosed HackerOne bug bounty reports by vulnerability class, technique, program, or keyword. Use when the user wants precedent / prior art for a vuln type, asks "how was X exploited", wants examples of a bug class, or any other skill needs to ground itself in real disclosed reports. Returns ranked matches with report IDs, severity, program handle, and excerpts.

report-search

This is the foundation skill — other bug-bounty skills call the same search helper.

How to search

Use the shared helper. Always run it from the repo root:

python3 .claude/skills/_lib/search_reports.py "<query terms>" [options]

Options:

--severity critical,high — filter by severity (critical/high/medium/low/none)
--handle shopify — filter by program handle (substring match)
--limit 20 — max results (default 20)
--full — include a body excerpt for each hit (read precedent without extra Reads)
--titles-only — match only titles/filenames (high-precision, less recall)

Scoring weighs title/filename matches above body matches, rewards covering more distinct query terms, and bonuses verbatim phrase hits.

Workflow

Run a broad query first (e.g. "cache deception", "oauth account takeover").
If too many/noisy results, add --titles-only or a --handle / --severity filter. If too few, drop filters or use broader synonyms.
Pick the most relevant 3–8 reports and Read their full files for technique detail, or pass --full to skim excerpts inline.
Synthesize: report the patterns, link each claim to a specific reports/<file> and #<id> (https://hackerone.com/reports/<id>) so the user can verify.

Tips

Vuln-class synonyms matter: try both ssrf and server side request forgery, idor and insecure direct object, ato and account takeover.
The corpus skews toward RCE, XSS, bypasses, CSRF, memory-safety, cache, SQLi, SSRF, IDOR, account-takeover, info-disclosure, rate-limit, subdomain-takeover.
Always cite report IDs. Never invent a report that search didn't return.