Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

report-search

Étoiles103

Forks31

Mis à jour26 juin 2026 à 19:51

Search the local corpus of ~10k disclosed HackerOne bug bounty reports by vulnerability class, technique, program, or keyword. Use when the user wants precedent / prior art for a vuln type, asks "how was X exploited", wants examples of a bug class, or any other skill needs to ground itself in real disclosed reports. Returns ranked matches with report IDs, severity, program handle, and excerpts.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

bugbountywithmarco

bugbountywithmarco/bugbounty-disclosed-reports

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Autres occupations informatiquesProfessions informatiques et mathématiques·SOC 15-1299

SKILL.md

readonly

name	report-search
description	Search the local corpus of ~10k disclosed HackerOne bug bounty reports by vulnerability class, technique, program, or keyword. Use when the user wants precedent / prior art for a vuln type, asks "how was X exploited", wants examples of a bug class, or any other skill needs to ground itself in real disclosed reports. Returns ranked matches with report IDs, severity, program handle, and excerpts.

report-search

Search the disclosed-report corpus in reports/ (one Markdown file per HackerOne report, format: title, Report Details, Reporter, Team/Handle, Vulnerability Information / Summary / Steps To Reproduce / Impact).

This is the foundation skill — other bug-bounty skills call the same search helper.

How to search

Use the shared helper. Always run it from the repo root:

python3 .claude/skills/_lib/search_reports.py "<query terms>" [options]

Options:

--severity critical,high — filter by severity (critical/high/medium/low/none)
--handle shopify — filter by program handle (substring match)
--limit 20 — max results (default 20)
--full — include a body excerpt for each hit (read precedent without extra Reads)
--titles-only — match only titles/filenames (high-precision, less recall)

Scoring weighs title/filename matches above body matches, rewards covering more distinct query terms, and bonuses verbatim phrase hits.

Workflow

Run a broad query first (e.g. "cache deception", "oauth account takeover").
If too many/noisy results, add --titles-only or a --handle / --severity filter. If too few, drop filters or use broader synonyms.
Pick the most relevant 3–8 reports and Read their full files for technique detail, or pass --full to skim excerpts inline.
Synthesize: report the patterns, link each claim to a specific reports/<file> and #<id> (https://hackerone.com/reports/<id>) so the user can verify.

Tips

Vuln-class synonyms matter: try both ssrf and server side request forgery, idor and insecure direct object, ato and account takeover.
The corpus skews toward RCE, XSS, bypasses, CSRF, memory-safety, cache, SQLi, SSRF, IDOR, account-takeover, info-disclosure, rate-limit, subdomain-takeover.
Always cite report IDs. Never invent a report that search didn't return.

Plus depuis ce dépôt

même dépôt

hunt

bugbountywithmarco/bugbounty-disclosed-reports

Hunt a target codebase or web app for a specific vulnerability class, primed with real exploitation patterns from the local disclosed-report corpus. Use when the user wants to find real vulnerabilities — "look for IDOR/SSRF/XSS/auth bypass in this code", "audit this for <vuln class>", "find bugs in <target>". Combines corpus-derived patterns with source/endpoint analysis and reports concrete candidate findings.

2026-06-26103

poc

bugbountywithmarco/bugbounty-disclosed-reports

Build a proof-of-concept / reproduction steps for a candidate finding — HTTP requests (curl/Burp), payloads, or a small script — modeled on the "Steps To Reproduce" sections of the local disclosed-report corpus. Use when the user wants to confirm or demonstrate a bug, "build a PoC", "give me the curl/requests to reproduce", or "write a script to exploit this".

2026-06-26103

program-intel

bugbountywithmarco/bugbounty-disclosed-reports

Summarize the historical bug patterns for a specific bug bounty program/team using the local disclosed-report corpus. Use when the user names a program (e.g. shopify, gitlab, nextcloud, nodejs, uber, tiktok) and wants to know what's been found there, recurring weak spots, hot endpoints/assets, and what to avoid duplicating. Helps focus hunting and avoid dupes.

2026-06-26103

recon-playbook

bugbountywithmarco/bugbounty-disclosed-reports

Build a hunting checklist / methodology for a vulnerability class or target tech stack, distilled from the local disclosed-report corpus. Use when the user asks "how do I hunt for X", "give me a methodology / checklist for X", "what should I test on a <tech> target", or wants a recon plan grounded in real disclosed bugs (e.g. SSRF, IDOR, rate-limit, cache deception, subdomain takeover, OAuth).

2026-06-26103

severity

bugbountywithmarco/bugbounty-disclosed-reports

Estimate the severity of a vulnerability finding and produce a CVSS 3.1 vector + impact framing, calibrated against how similar findings were rated in the local disclosed-report corpus. Use when the user asks "how severe is this", "what CVSS score", "how should I rate this", or needs an impact statement for a report.

2026-06-26103

write-report

bugbountywithmarco/bugbounty-disclosed-reports

Write a disclosure-quality bug bounty report for a finding, matching the HackerOne report format used in this repo's corpus. Use when the user has a vulnerability and wants it written up — "write a report for this", "draft a HackerOne submission", "turn this finding into a report". Produces title, summary, steps to reproduce, impact, severity, and remediation, few-shot styled on real disclosed reports.

2026-06-26103

name	report-search
description	Search the local corpus of ~10k disclosed HackerOne bug bounty reports by vulnerability class, technique, program, or keyword. Use when the user wants precedent / prior art for a vuln type, asks "how was X exploited", wants examples of a bug class, or any other skill needs to ground itself in real disclosed reports. Returns ranked matches with report IDs, severity, program handle, and excerpts.

report-search

This is the foundation skill — other bug-bounty skills call the same search helper.

How to search

Use the shared helper. Always run it from the repo root:

python3 .claude/skills/_lib/search_reports.py "<query terms>" [options]

Options:

--severity critical,high — filter by severity (critical/high/medium/low/none)
--handle shopify — filter by program handle (substring match)
--limit 20 — max results (default 20)
--full — include a body excerpt for each hit (read precedent without extra Reads)
--titles-only — match only titles/filenames (high-precision, less recall)

Scoring weighs title/filename matches above body matches, rewards covering more distinct query terms, and bonuses verbatim phrase hits.

Workflow

Run a broad query first (e.g. "cache deception", "oauth account takeover").
If too many/noisy results, add --titles-only or a --handle / --severity filter. If too few, drop filters or use broader synonyms.
Pick the most relevant 3–8 reports and Read their full files for technique detail, or pass --full to skim excerpts inline.
Synthesize: report the patterns, link each claim to a specific reports/<file> and #<id> (https://hackerone.com/reports/<id>) so the user can verify.

Tips

Vuln-class synonyms matter: try both ssrf and server side request forgery, idor and insecure direct object, ato and account takeover.
The corpus skews toward RCE, XSS, bypasses, CSRF, memory-safety, cache, SQLi, SSRF, IDOR, account-takeover, info-disclosure, rate-limit, subdomain-takeover.
Always cite report IDs. Never invent a report that search didn't return.