disclose-finding

name

disclose-finding

description

Help the user act as a good-faith reporter when a capture run incidentally surfaces something that looks like an unauthenticated endpoint exposing data that probably shouldn't be public, a leaked token in a response, or another security-relevant finding. Drafts a courteous, vendor-friendly disclosure email, identifies the right contact (security.txt, security@, abuse@, public bug-bounty programme), and writes the report into the maps repo so the user has a record. White-hat use only. Use when the user says "we found something we should report", "looks like an open endpoint", "draft a disclosure email for this finding".

disclose-finding

A capture run is intended to map endpoints the user can build a legitimate integration against. Occasionally, it incidentally surfaces something that looks like a security issue — an endpoint that returns data without auth when it clearly should require it, a token or key embedded in a response body, an IDOR-shaped pattern. This skill helps the user behave well when that happens: stop, document, disclose, move on.

This skill is not a research or testing tool. It does not probe further, enumerate, or attempt to confirm impact. The premise is that the finding is already incidental — Claude has seen it once, in normal use, and the next responsible step is reporting.

When to invoke

The user (or a previous skill in this plugin) flags one of:

• An endpoint returning what looks like personal or sensitive data without an auth header.
• A response body containing what looks like a credential, internal token, private key, or DB connection string.
• A response disclosing internal infrastructure details that shouldn't be public (stack traces with paths, internal hostnames, debug routes).
• An ID-shaped parameter that, when changed, returns another user's data — and the user noticed by accident, not by trying.

If the user is trying to find this kind of thing rather than incidentally surfacing it, this is the wrong plugin and the wrong skill. Tell them to use a proper bug-bounty or pentest workflow under explicit scope.