security-bounty-hunter

Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No known issues

Fix and improve this skill with Tessl

tessl review fix ./skills/security-bounty-hunter/SKILL.md

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a lean, well-organized methodology skill with a clear sequenced workflow and an explicit quality-gate checklist, but actionability sits at 2 because most guidance is procedural with only one executable command and a template rather than fully copy-paste-ready tooling.

Suggestions

Add one or two more concrete, runnable commands beyond the single semgrep invocation (e.g., a duplicate-check command or a PoC scaffolding snippet) to raise actionability.

Provide a minimal worked example that traces one pattern (e.g. SSRF) from entrypoint to sink to PoC, making the workflow steps concrete instead of directional.

Optionally externalize the report template into a referenced file if the skill grows, though the current single-file structure is appropriate at this size.

Dimension	Reasoning	Score
Conciseness	The body is lean and efficient: it lists vulnerability patterns in a compact table without explaining what SSRF or SQL injection is, gives a single semgrep command, and a copy-paste report template, assuming Claude's competence throughout. It does not include the unnecessary explanations that would drop it to 2.	3 / 3
Actionability	Concrete artifacts are limited to one executable command (semgrep) and a report-structure template; the workflow steps ('Find real entrypoints', 'Prove user control reaches a meaningful sink') are specific but directional rather than executable, matching 'some concrete guidance but incomplete' better than 'fully executable, copy-paste ready'.	2 / 3
Workflow Clarity	A clear 7-step sequenced workflow is paired with an explicit 'Quality Gate' checklist that acts as a validation checkpoint before submission, plus a triage filter loop, satisfying 'clear sequence with explicit validation steps; checklists for complex processes'.	3 / 3
Progressive Disclosure	This is a self-contained, single-purpose skill with no bundle files and no need for external references; content is well-organized into clearly labeled sections (When to Use, In-Scope Patterns, Skip These, Workflow, Quality Gate), which the rubric allows to score 3 for simple skills via well-organized sections.	3 / 3
	Total	11 / 12 Passed

Description

57%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, carving a clear bounty-hunting niche, but it lacks an explicit 'Use when...' trigger clause and only partial coverage of natural trigger terms, capping both completeness and trigger-term quality at 2.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when preparing a Huntr, HackerOne, or responsible-disclosure submission for a repository.'

Broaden trigger terms to include natural variations users say, such as 'CVE', 'exploit', 'responsible disclosure', and '0-day'.

Name one or two more concrete actions (e.g. 'triage static-analysis findings and draft bounty reports') to lift specificity to 3.

Dimension	Reasoning	Score
Specificity	It names the domain ('security issues in repositories') and a primary action ('Hunt for exploitable, bounty-worthy security issues'), but the second sentence is a qualifier rather than a second concrete action, so it does not reach the 'lists multiple specific concrete actions' anchor of 3.	2 / 3
Completeness	It clearly answers 'what does this do' but provides no 'Use when...' clause or equivalent explicit trigger guidance, which the guidelines cap at 2.	2 / 3
Trigger Term Quality	Relevant natural terms are present ('security issues', 'bounty-worthy', 'vulnerabilities', 'reports'), but common variations a user might say ('CVE', 'exploit', 'responsible disclosure', 'Huntr', 'HackerOne') are absent, leaving only partial coverage.	2 / 3
Distinctiveness Conflict Risk	The niche is sharply carved ('bounty-worthy', 'remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings'), distinguishing it clearly from a general security-review skill and making wrong-skill triggering unlikely.	3 / 3
	Total	9 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: affaan-m/ECC
Commit: 754b8dd

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.