hackerone

Name: hackerone
Author: transilienceai

423stars74forks

How to install hackerone?

transilienceai/communitytools/hackerone

$npx -y skills add transilienceai/communitytools --skill hackerone

Installs into the current project.

Summary

HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.

Files · 1

View on GitHub

SKILL.md

1	# HackerOne Bug Bounty
2
3	Automates: scope parsing → parallel testing per asset → authoritative finding validation → submission reports.
4
5	## Quick start
6
7	1. Input: HackerOne program URL or scope CSV.
8	2. Parse scope and program guidelines.
9	3. Spawn one coordinator per eligible asset (parallel).
10	4. Each coordinator runs the standard engagement flow (see `skills/coordination/SKILL.md`).
11	5. Run the `validate-findings` workflow per asset (authoritative submission gate). Generate HackerOne reports from the validated set ONLY — never submit a finding that is not `VALID`/`REPAIRED`.
12
13	## Scope CSV format
14
15	Expected columns:
16	- `identifier` — asset URL/domain.
17	- `asset_type` — URL, WILDCARD, API, CIDR.
18	- `eligible_for_submission` — must be `true`.
19	- `max_severity` — critical / high / medium / low.
20	- `instruction` — asset-specific notes.
21
22	Parse with `skills/hackerone/tools/csv_parser.py`. Filter for `eligible_for_submission=true`.
23
24	## Agent deployment
25
26	One coordinator per asset, spawned in parallel:
27
28	```python
29	coordinator_role = Read("skills/coordination/SKILL.md")
30	Agent(prompt=f"{coordinator_role}\n\nTARGET: {asset_url}\nSCOPE: {program_guidelines}\nOUTPUT_DIR: ...",
31	run_in_background=True)
32	```
33
34	10 assets → 10 parallel coordinators (~2-4 h vs 20-40 h sequential). Each coordinator follows `skills/coordination/SKILL.md` and `reference/role-matrix.md`.
35
36	## Finding validation (authoritative submission gate)
37
38	Every finding requires `poc.py` (executable exploit), `poc_output.txt` (timestamped execution proof), manual repro steps, and evidence (screenshots / HTTP captures / video). This is the input the validator consumes.
39
40	After each asset's coordinator returns, the orchestrator runs the `validate-findings` workflow for that asset and submits ONLY findings it marks `VALID` or `REPAIRED`:
41
42	```python
43	v = Workflow(name="validate-findings", args={
44	"output_dir": asset_output_dir, # the coordinator's OUTPUT_DIR
45	"target": asset_url,
46	"business_tier": "revenue", # production/external bug-bounty scope; else "unknown"
47	"votes": 3, # adversarial refuters per finding (bounty = stricter)
48	"repair": True, # regenerate broken/absent PoCs so each finding has a runnable evidence script
49	"strict": True, # one failed gate => REJECTED
50	})
51	# v.counts -> {total, valid, repaired, rejected}; v.validated[] / v.rejected[]
52	# Verdicts at {asset_output_dir}/artifacts/validated/{id}.json (+ false-positives/).
53	# Asset report at {asset_output_dir}/reports/validation-report.md.
54	```
55
56	`validate-findings` is the authoritative gate because it directly preempts the most common HackerOne rejections: it verifies each CVE against NVD + a recomputed CVSS base score (from the vector) + CISA KEV + the vendor advisory, runs (and repairs) every PoC until it emits the evidence that proves the issue, recomputes the risk/severity, corroborates every claim against raw evidence, and kills false positives via adversarial refutation.
57
58	The orchestrator is the only layer that runs this workflow (it is top-level; the workflow is one level below — legal nesting). To avoid double work, coordinators may treat their interleaved per-finding validators (run the instant each candidate is materialized) as a provisional self-check; the standalone `validate-findings` verdict is authoritative for submission. A `REJECTED` finding is a false positive — it never enters a submission, an appendix, or a count; its `artifacts/false-positives/{id}.json` is the sole record. Likewise a coordinator-dropped candidate (uncured DEMOTED, in `artifacts/dropped/`) is never submitted.
59
60	The HackerOne PoC contract is a superset of the standard finding contract (`skills/coordination/reference/validator-role.md`).
61
62	## Submission report format
63
64	Build each report from a validated finding only. Required sections per HackerOne standard:
65	1. Summary (2-3 sentences).
66	2. Severity (CVSS v3.1 + business impact) — use the score `validate-findings` recomputed from the vector and the risk bucket it assigned, not a hand-typed number.
67	3. Steps to Reproduce (numbered, clear) — mirror the validated `verification-script.py`.
68	4. Visual Evidence (from `evidence/validation/`).
69	5. Impact (realistic attack scenario).
70	6. Remediation (actionable fixes).
71
72	Validate report format with `skills/hackerone/tools/report_validator.py` (complements the finding validation).
73
74	## Output structure
75
76	Standard `OUTPUT_DIR` (`skills/coordination/reference/output-discipline.md`) plus a per-asset `reports/submissions/` containing the platform-ready markdown. `validate-findings` writes the verdicts under `artifacts/validated\|false-positives/` and the asset `reports/validation-report.md`.
77
78	```
79	{OUTPUT_DIR}/
80	├── findings/
81	│ └── finding-NN

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

hackerone

423stars74forks

View on GitHub

How to install hackerone?

transilienceai/communitytools/hackerone

$npx -y skills add transilienceai/communitytools --skill hackerone

Installs into the current project.

Summary

HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.

Files · 1

View on GitHub

SKILL.md

1	# HackerOne Bug Bounty
2
3	Automates: scope parsing → parallel testing per asset → authoritative finding validation → submission reports.
4
5	## Quick start
6
7	1. Input: HackerOne program URL or scope CSV.
8	2. Parse scope and program guidelines.
9	3. Spawn one coordinator per eligible asset (parallel).
10	4. Each coordinator runs the standard engagement flow (see `skills/coordination/SKILL.md`).
11	5. Run the `validate-findings` workflow per asset (authoritative submission gate). Generate HackerOne reports from the validated set ONLY — never submit a finding that is not `VALID`/`REPAIRED`.
12
13	## Scope CSV format
14
15	Expected columns:
16	- `identifier` — asset URL/domain.
17	- `asset_type` — URL, WILDCARD, API, CIDR.
18	- `eligible_for_submission` — must be `true`.
19	- `max_severity` — critical / high / medium / low.
20	- `instruction` — asset-specific notes.
21
22	Parse with `skills/hackerone/tools/csv_parser.py`. Filter for `eligible_for_submission=true`.
23
24	## Agent deployment
25
26	One coordinator per asset, spawned in parallel:
27
28	```python
29	coordinator_role = Read("skills/coordination/SKILL.md")
30	Agent(prompt=f"{coordinator_role}\n\nTARGET: {asset_url}\nSCOPE: {program_guidelines}\nOUTPUT_DIR: ...",
31	run_in_background=True)
32	```
33
34	10 assets → 10 parallel coordinators (~2-4 h vs 20-40 h sequential). Each coordinator follows `skills/coordination/SKILL.md` and `reference/role-matrix.md`.
35
36	## Finding validation (authoritative submission gate)
37
38	Every finding requires `poc.py` (executable exploit), `poc_output.txt` (timestamped execution proof), manual repro steps, and evidence (screenshots / HTTP captures / video). This is the input the validator consumes.
39
40	After each asset's coordinator returns, the orchestrator runs the `validate-findings` workflow for that asset and submits ONLY findings it marks `VALID` or `REPAIRED`:
41
42	```python
43	v = Workflow(name="validate-findings", args={
44	"output_dir": asset_output_dir, # the coordinator's OUTPUT_DIR
45	"target": asset_url,
46	"business_tier": "revenue", # production/external bug-bounty scope; else "unknown"
47	"votes": 3, # adversarial refuters per finding (bounty = stricter)
48	"repair": True, # regenerate broken/absent PoCs so each finding has a runnable evidence script
49	"strict": True, # one failed gate => REJECTED
50	})
51	# v.counts -> {total, valid, repaired, rejected}; v.validated[] / v.rejected[]
52	# Verdicts at {asset_output_dir}/artifacts/validated/{id}.json (+ false-positives/).
53	# Asset report at {asset_output_dir}/reports/validation-report.md.
54	```
55
56	`validate-findings` is the authoritative gate because it directly preempts the most common HackerOne rejections: it verifies each CVE against NVD + a recomputed CVSS base score (from the vector) + CISA KEV + the vendor advisory, runs (and repairs) every PoC until it emits the evidence that proves the issue, recomputes the risk/severity, corroborates every claim against raw evidence, and kills false positives via adversarial refutation.
57
58	The orchestrator is the only layer that runs this workflow (it is top-level; the workflow is one level below — legal nesting). To avoid double work, coordinators may treat their interleaved per-finding validators (run the instant each candidate is materialized) as a provisional self-check; the standalone `validate-findings` verdict is authoritative for submission. A `REJECTED` finding is a false positive — it never enters a submission, an appendix, or a count; its `artifacts/false-positives/{id}.json` is the sole record. Likewise a coordinator-dropped candidate (uncured DEMOTED, in `artifacts/dropped/`) is never submitted.
59
60	The HackerOne PoC contract is a superset of the standard finding contract (`skills/coordination/reference/validator-role.md`).
61
62	## Submission report format
63
64	Build each report from a validated finding only. Required sections per HackerOne standard:
65	1. Summary (2-3 sentences).
66	2. Severity (CVSS v3.1 + business impact) — use the score `validate-findings` recomputed from the vector and the risk bucket it assigned, not a hand-typed number.
67	3. Steps to Reproduce (numbered, clear) — mirror the validated `verification-script.py`.
68	4. Visual Evidence (from `evidence/validation/`).
69	5. Impact (realistic attack scenario).
70	6. Remediation (actionable fixes).
71
72	Validate report format with `skills/hackerone/tools/report_validator.py` (complements the finding validation).
73
74	## Output structure
75
76	Standard `OUTPUT_DIR` (`skills/coordination/reference/output-discipline.md`) plus a per-asset `reports/submissions/` containing the platform-ready markdown. `validate-findings` writes the verdicts under `artifacts/validated\|false-positives/` and the asset `reports/validation-report.md`.
77
78	```
79	{OUTPUT_DIR}/
80	├── findings/
81	│ └── finding-NN

People who liked this also viewed

6 picks

Type