ai-report-writing-guardrails

Name: ai-report-writing-guardrails
Author: ShulkwiSEC

18stars5forks

How to install ai-report-writing-guardrails?

shulkwisec/bb-huge/ai-report-writing-guardrails

$npx -y skills add ShulkwiSEC/bb-huge --skill ai-report-writing-guardrails

Installs into the current project.

Summary

Prevent common AI report pitfalls — bug blending, inflated threat models, and generic language. Train Claude with your best past reports for concise, technical submissions. Based on Critical Thinking Bug Bounty Podcast Episode 166.

Files · 1

View on GitHub

SKILL.md

1	# AI Report Writing Guardrails
2
3	## When to Use
4	- When using Claude or any LLM to draft bug bounty vulnerability reports.
5	- When reviewing AI-generated reports before submission to HackerOne/Bugcrowd.
6	- When AI reports are getting marked as N/A, Informational, or Duplicate due to quality issues.
7	- When teaching Claude your personal writing style to produce better reports.
8
9	## Prerequisites
10	- 3-5 of your best past bug bounty reports (ones that got triaged quickly and paid well)
11	- Claude Code CLI configured for the target program
12	- Understanding of CVSS 4.0 scoring
13
14	## Core Problem: AI Reports Get You Banned
15
16	> **"AI blends 2-3 separate bugs into one report. Program managers HATE that.
17	> And the threat modeling is weak — it calls a paywall bypass 'complete security degradation'."**
18	> — Critical Thinking Podcast, Ep. 166
19
20	### The 3 Deadly AI Report Sins
21
22	\| Sin \| What Happens \| Example \|
23	\|-----\|-------------\|---------\|
24	\| Bug Blending \| AI mixes 2-3 separate vulnerabilities into 1 report \| "Found XSS, CSRF, and IDOR in the dashboard" → should be 3 separate reports \|
25	\| Inflated Threat Model \| AI exaggerates impact beyond technical reality \| Paywall bypass → "complete security degradation of all financial systems" \|
26	\| AI Voice Detection \| Triage team recognizes LLM language and downgrades \| "It's worth noting", "This vulnerability poses a significant risk", "Certainly" \|
27
28	Result: Report gets N/A'd, your reputation score drops, you may get warned or banned.
29
30	## Workflow
31
32	### Phase 1: The Bug Blending Check
33
34	Before submitting any AI report, apply the One Bug = One Report rule:
35
36	```markdown
37	## Bug Blending Checklist
38	For each AI-generated report, ask:
39
40	1. How many DISTINCT attack flows are described?
41	- If > 1 → SPLIT into separate reports
42
43	2. Does each CWE map to the same root cause?
44	- Different CWEs = different reports (CWE-79 XSS ≠ CWE-352 CSRF)
45
46	3. Can each finding be independently reproduced?
47	- If yes → separate reports
48	- If chained (A enables B) → one report with clear chain
49
50	4. Remove sentences containing "Additionally", "Furthermore", "Moreover"
51	that introduce DIFFERENT vulnerability classes
52	```
53
54	Before (AI Output — Bug Blended):
55	```
56	## Vulnerability Report: Multiple Security Issues in User Dashboard
57
58	The user dashboard at /dashboard contains a stored XSS vulnerability
59	via the bio field. Additionally, the same endpoint is vulnerable to
60	CSRF attacks as it lacks anti-CSRF tokens. Furthermore, the API
61	endpoint /api/v2/users/{id} has an IDOR vulnerability...
62	```
63
64	After (Fixed — One Bug per Report):
65	```
66	## Report 1: Stored XSS in /dashboard Bio Field Allows Session Hijack
67	[XSS details only — CWE-79]
68
69	## Report 2: CSRF on /dashboard/settings Enables Profile Takeover
70	[CSRF details only — CWE-352]
71
72	## Report 3: IDOR in /api/v2/users/{id} Exposes All User Records
73	[IDOR details only — CWE-639]
74	```
75
76	### Phase 2: Threat Model Reality Check
77
78	AI tends to inflate impact. Run every AI report through this filter:
79
80	```markdown
81	## Threat Model Verification Checklist
82
83	1. ❓ "What EXACTLY can an attacker steal/modify/destroy?"
84	- ❌ "Complete security degradation" → meaningless
85	- ✅ "Read 4.2M user email addresses without auth" → specific
86
87	2. ❓ "What prerequisites does the attacker need?"
88	- ❌ Assumes zero prerequisites → unrealistic
89	- ✅ "Requires authenticated low-privilege account" → honest
90
91	3. ❓ "Is the CVSS score defensible?"
92	- Test: Would you argue this score to a security engineer?
93	- Common AI inflation: rating a cosmetic issue as High (7.0+)
94
95	4. ❓ "Does the 'Impact' section contain at LEAST one real number?"
96	- ❌ "Affects many users" → useless
97	- ✅ "Affects 12,847 active accounts on this endpoint" → credible
98
99	5. ❓ "Is the remediation generic or specific?"
100	- ❌ "Implement proper input validation" → tells nothing
101	- ✅ "Add parameterized query at line 42 of UserController.js" → actionable
102	```
103
104	AI Output (inflated):
105	```
106	Impact: This vulnerability poses a significant security risk,
107	potentially leading to complete compromise of the application
108	and its underlying infrastructure.
109	```
110
111	Fixed (realistic):
112	```
113	Impact: An unauthenticated attacker can read the email, name,
114	and phone number of any registe

People who liked this also viewed

6 picks

Type

ai-report-writing-guardrails

18stars5forks

View on GitHub

How to install ai-report-writing-guardrails?

shulkwisec/bb-huge/ai-report-writing-guardrails

$npx -y skills add ShulkwiSEC/bb-huge --skill ai-report-writing-guardrails

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AI Report Writing Guardrails
2
3	## When to Use
4	- When using Claude or any LLM to draft bug bounty vulnerability reports.
5	- When reviewing AI-generated reports before submission to HackerOne/Bugcrowd.
6	- When AI reports are getting marked as N/A, Informational, or Duplicate due to quality issues.
7	- When teaching Claude your personal writing style to produce better reports.
8
9	## Prerequisites
10	- 3-5 of your best past bug bounty reports (ones that got triaged quickly and paid well)
11	- Claude Code CLI configured for the target program
12	- Understanding of CVSS 4.0 scoring
13
14	## Core Problem: AI Reports Get You Banned
15
16	> **"AI blends 2-3 separate bugs into one report. Program managers HATE that.
17	> And the threat modeling is weak — it calls a paywall bypass 'complete security degradation'."**
18	> — Critical Thinking Podcast, Ep. 166
19
20	### The 3 Deadly AI Report Sins
21
22	\| Sin \| What Happens \| Example \|
23	\|-----\|-------------\|---------\|
24	\| Bug Blending \| AI mixes 2-3 separate vulnerabilities into 1 report \| "Found XSS, CSRF, and IDOR in the dashboard" → should be 3 separate reports \|
25	\| Inflated Threat Model \| AI exaggerates impact beyond technical reality \| Paywall bypass → "complete security degradation of all financial systems" \|
26	\| AI Voice Detection \| Triage team recognizes LLM language and downgrades \| "It's worth noting", "This vulnerability poses a significant risk", "Certainly" \|
27
28	Result: Report gets N/A'd, your reputation score drops, you may get warned or banned.
29
30	## Workflow
31
32	### Phase 1: The Bug Blending Check
33
34	Before submitting any AI report, apply the One Bug = One Report rule:
35
36	```markdown
37	## Bug Blending Checklist
38	For each AI-generated report, ask:
39
40	1. How many DISTINCT attack flows are described?
41	- If > 1 → SPLIT into separate reports
42
43	2. Does each CWE map to the same root cause?
44	- Different CWEs = different reports (CWE-79 XSS ≠ CWE-352 CSRF)
45
46	3. Can each finding be independently reproduced?
47	- If yes → separate reports
48	- If chained (A enables B) → one report with clear chain
49
50	4. Remove sentences containing "Additionally", "Furthermore", "Moreover"
51	that introduce DIFFERENT vulnerability classes
52	```
53
54	Before (AI Output — Bug Blended):
55	```
56	## Vulnerability Report: Multiple Security Issues in User Dashboard
57
58	The user dashboard at /dashboard contains a stored XSS vulnerability
59	via the bio field. Additionally, the same endpoint is vulnerable to
60	CSRF attacks as it lacks anti-CSRF tokens. Furthermore, the API
61	endpoint /api/v2/users/{id} has an IDOR vulnerability...
62	```
63
64	After (Fixed — One Bug per Report):
65	```
66	## Report 1: Stored XSS in /dashboard Bio Field Allows Session Hijack
67	[XSS details only — CWE-79]
68
69	## Report 2: CSRF on /dashboard/settings Enables Profile Takeover
70	[CSRF details only — CWE-352]
71
72	## Report 3: IDOR in /api/v2/users/{id} Exposes All User Records
73	[IDOR details only — CWE-639]
74	```
75
76	### Phase 2: Threat Model Reality Check
77
78	AI tends to inflate impact. Run every AI report through this filter:
79
80	```markdown
81	## Threat Model Verification Checklist
82
83	1. ❓ "What EXACTLY can an attacker steal/modify/destroy?"
84	- ❌ "Complete security degradation" → meaningless
85	- ✅ "Read 4.2M user email addresses without auth" → specific
86
87	2. ❓ "What prerequisites does the attacker need?"
88	- ❌ Assumes zero prerequisites → unrealistic
89	- ✅ "Requires authenticated low-privilege account" → honest
90
91	3. ❓ "Is the CVSS score defensible?"
92	- Test: Would you argue this score to a security engineer?
93	- Common AI inflation: rating a cosmetic issue as High (7.0+)
94
95	4. ❓ "Does the 'Impact' section contain at LEAST one real number?"
96	- ❌ "Affects many users" → useless
97	- ✅ "Affects 12,847 active accounts on this endpoint" → credible
98
99	5. ❓ "Is the remediation generic or specific?"
100	- ❌ "Implement proper input validation" → tells nothing
101	- ✅ "Add parameterized query at line 42 of UserController.js" → actionable
102	```
103
104	AI Output (inflated):
105	```
106	Impact: This vulnerability poses a significant security risk,
107	potentially leading to complete compromise of the application
108	and its underlying infrastructure.
109	```
110
111	Fixed (realistic):
112	```
113	Impact: An unauthenticated attacker can read the email, name,
114	and phone number of any registe

People who liked this also viewed

6 picks

Type