security-bounty-hunter

Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings. Use when hunting reportable, remotely reachable vulnerabilities in a repository.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, well-structured hunting skill that assumes Claude's competence and leads with concrete artifacts (CWE table, semgrep command, report template, quality gate). The main gap is that several workflow steps stay at the guidance level rather than giving executable specifics, and the validation feedback loop is implicit rather than spelled out.

Suggestions

Tighten a couple of abstract workflow steps into concrete actions, e.g. for 'Prove user control reaches a meaningful sink' give an example trace technique (grep from entrypoint to sink, or a curl invocation shape).

Make the validate-fix-retry loop explicit in the Workflow or Quality Gate, e.g. 'If a quality-gate check fails, fix and re-run the PoC before drafting the report.'

Consider extracting the report-structure template and CWE pattern table into a reference file so the SKILL.md body stays a lean overview with one-level-deep pointers.

Dimension	Reasoning	Score
Conciseness	Lean and dense: a CWE-pattern table, a skip list, a numbered workflow, one executable semgrep command, a report template, and a quality-gate checklist, with no padding or explanation of concepts Claude already knows.	5 / 5
Actionability	Provides an executable semgrep command, a concrete triage filter list, a copy-paste report template, and a quality-gate checklist, but several workflow steps ('Read the real code path end to end', 'Prove user control reaches a meaningful sink') are high-level guidance rather than executable specifics.	4 / 5
Workflow Clarity	A clear 7-step sequence is present and the 'Quality Gate' section supplies an explicit pre-submission validation checkpoint for an outward-facing operation, but there is no explicit validate-fix-retry feedback loop, keeping it below the top anchor.	4 / 5
Progressive Disclosure	Well-organized into clearly headed sections with no nested or buried references, and the skill is appropriately self-contained with no bundle files; at ~90 lines it sits just above the under-50-line simple-skill exception that would allow a 5.	4 / 5
	Total	17 / 20 Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that clearly states a distinct niche (bounty-worthy, remotely reachable vulnerabilities) and provides an explicit 'Use when' trigger. It is slightly more of a framing/filtering statement than a list of concrete capabilities, which keeps specificity from the top anchor.

Dimension	Reasoning	Score
Specificity	Names the domain and concrete framing actions ('Hunt for exploitable, bounty-worthy security issues', 'Focuses on remotely reachable vulnerabilities that qualify for real reports') but these are filtering descriptors rather than a comprehensive list of distinct capabilities, fitting the 3 anchor better than 4.	3 / 5
Completeness	Explicitly answers both what ('Hunt for exploitable, bounty-worthy security issues... Focuses on remotely reachable vulnerabilities that qualify for real reports') and when ('Use when hunting reportable, remotely reachable vulnerabilities in a repository').	5 / 5
Trigger Term Quality	Good natural keyword coverage ('bounty-worthy', 'security issues', 'remotely reachable vulnerabilities', 'reports', 'repositories') with an explicit 'Use when hunting...' trigger, though a few common synonyms (HackerOne, Huntr, CVE) appear only in the body, not the description.	4 / 5
Distinctiveness Conflict Risk	Clear niche ('bounty-worthy', 'remotely reachable vulnerabilities in repositories', 'real reports vs noisy local-only findings') with distinct triggers and minimal overlap risk with general security-review skills.	5 / 5
	Total	17 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: affaan-m/ECC
Path: skills/security-bounty-hunter/SKILL.md
Commit: d8409a4

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.