Hunt a target codebase or web app for a specific vulnerability class, primed with real exploitation patterns from the local disclosed-report corpus. Use when the user wants to find real vulnerabilities — "look for IDOR/SSRF/XSS/auth bypass in this code", "audit this for <vuln class>", "find bugs in <target>". Combines corpus-derived patterns with source/endpoint analysis and reports concrete candidate findings.
Build a proof-of-concept / reproduction steps for a candidate finding — HTTP requests (curl/Burp), payloads, or a small script — modeled on the "Steps To Reproduce" sections of the local disclosed-report corpus. Use when the user wants to confirm or demonstrate a bug, "build a PoC", "give me the curl/requests to reproduce", or "write a script to exploit this".
Summarize the historical bug patterns for a specific bug bounty program/team using the local disclosed-report corpus. Use when the user names a program (e.g. shopify, gitlab, nextcloud, nodejs, uber, tiktok) and wants to know what's been found there, recurring weak spots, hot endpoints/assets, and what to avoid duplicating. Helps focus hunting and avoid dupes.
Build a hunting checklist / methodology for a vulnerability class or target tech stack, distilled from the local disclosed-report corpus. Use when the user asks "how do I hunt for X", "give me a methodology / checklist for X", "what should I test on a <tech> target", or wants a recon plan grounded in real disclosed bugs (e.g. SSRF, IDOR, rate-limit, cache deception, subdomain takeover, OAuth).
Search the local corpus of ~10k disclosed HackerOne bug bounty reports by vulnerability class, technique, program, or keyword. Use when the user wants precedent / prior art for a vuln type, asks "how was X exploited", wants examples of a bug class, or any other skill needs to ground itself in real disclosed reports. Returns ranked matches with report IDs, severity, program handle, and excerpts.
Estimate the severity of a vulnerability finding and produce a CVSS 3.1 vector + impact framing, calibrated against how similar findings were rated in the local disclosed-report corpus. Use when the user asks "how severe is this", "what CVSS score", "how should I rate this", or needs an impact statement for a report.
Write a disclosure-quality bug bounty report for a finding, matching the HackerOne report format used in this repo's corpus. Use when the user has a vulnerability and wants it written up — "write a report for this", "draft a HackerOne submission", "turn this finding into a report". Produces title, summary, steps to reproduce, impact, severity, and remediation, few-shot styled on real disclosed reports.