CtrlK
BlogDocsLog inGet started
Tessl Logo

bounty-report-formatter

Bug bounty report formatting for HackerOne, Bugcrowd, Immunefi, and GitHub Security Advisories. Load after validate_finding succeeds and the finding needs to be submitted to a bounty program.

64

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/plugins/verifier/bounty-report/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable and token-efficient, with a strong validation checklist driving workflow clarity and clean section structure. The main gaps are the absence of an explicit feedback loop and a Platform-Specific Notes section that could be externalized as a reference file.

Suggestions

Add an explicit feedback loop after the Quality Checklist (e.g., 'If any item fails, revise the report and re-check before writing to workspace/findings') to reach the workflow_clarity 5 anchor.

Move the per-platform notes (HackerOne/Bugcrowd/GitHub/Immunefi) into a references/PLATFORMS.md and link to it from the body to improve progressive_disclosure separation.

Trim two of the six title examples and drop the fully populated CVSS example table to a compact template to tighten conciseness toward the 5 anchor.

DimensionReasoningScore

Conciseness

The body is lean and assumes Claude knows CVSS and the platforms, with no concept padding; minor trim candidates exist (six title examples, a fully populated CVSS table template) that keep it just below the 'every token earns its place' anchor.

4 / 5

Actionability

It provides a copy-paste-ready report template with placeholders, a concrete remediation diff, a CVSS calculator URL pattern, and exact VRT P1-P4 ranges, covering the common cases with executable, specific guidance.

5 / 5

Workflow Clarity

A clear sequence (title convention, template, checklist, platform notes) is anchored by a 15-item Quality Checklist that acts as explicit validation before submission, but there is no validate->fix->retry feedback loop, which the 5 anchor requires.

4 / 5

Progressive Disclosure

Sections are well-organized with clear headers and no nested references, and no bundle files exist to misuse; the Platform-Specific Notes block is the one candidate that could be split into a reference file, leaving it just short of a fully split 5.

4 / 5

Total

17

/

20

Passed

Description

73%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, well-triggered, and highly distinct, clearly answering both what it does and when to load it. Its main weakness is that the 'when' clause is a workflow precondition rather than natural user-mention triggers, and a few useful synonyms live only in metadata.

Suggestions

Add a 'Use when the user mentions bug bounty writeups, HackerOne/Bugcrowd submissions, or CVSS triage reports' clause so the trigger is phrased as user-mention language rather than only a workflow precondition.

Surface 1-2 more concrete actions (e.g., 'compose CVSS vectors and platform-ready writeups') to lift specificity from a single action to comprehensive coverage.

Pull key synonyms currently only in metadata when_to_use ('writeup', 'cvss', 'triage') into the description body for stronger natural-term coverage.

DimensionReasoningScore

Specificity

The phrase 'Bug bounty report formatting' names the domain and one concrete action (formatting) across four named platforms, but does not enumerate multiple distinct capabilities, matching the anchor that lists 1-2 concrete actions without comprehensive coverage.

3 / 5

Completeness

It clearly states what it does ('Bug bounty report formatting for ...') and gives explicit when guidance ('Load after validate_finding succeeds and the finding needs to be submitted to a bounty program'), but the when is workflow-conditioned rather than user-mention trigger phrasing, so it is not a 5.

4 / 5

Trigger Term Quality

Natural platform keywords users would say are present ('HackerOne', 'Bugcrowd', 'Immunefi', 'GitHub Security Advisories', 'bounty program'), but synonyms like 'writeup', 'triage', and 'cvss' appear only in metadata rather than the description itself, leaving a few natural terms missing.

4 / 5

Distinctiveness Conflict Risk

The named-platform niche ('HackerOne, Bugcrowd, Immunefi, and GitHub Security Advisories') plus the validate_finding precondition create a clear, distinct trigger set with minimal overlap risk against other skills.

5 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.