evidence-hygiene

Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails, phones, faces — vs what is safe to leave — usernames, trace IDs, request bodies), HAR file sanitization (jq filters for Cookie/Set-Cookie/Authorization headers), Burp Repeater/Intruder screenshot hygiene (hide request body, show only Results table for rate-limit attacks), Chrome DevTools Console PoC patterns (credentials include so cookies are not echoed, labeled console.log), screenshot capture order, filename conventions, post-submission rotation hygiene. Use BEFORE any PoC screenshot, BEFORE attaching a HAR, or whenever preparing evidence with session cookies or other-user PII. Pairs with bugcrowd-reporting and report-writing.

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced skill body with executable code, checklists, and validation feedback loops. The main weakness is mild redundancy across the three inter-skill-relationship sections and the absence of any progressive-disclosure split for reference material.

Suggestions

Consolidate §9 'Pairing with Other Skills', 'Notes on usage', and 'Related Skills & Chains' into a single section to remove repeated descriptions of the same sibling-skill boundaries.

Move the detailed jq HAR-sanitization filters and per-OS screenshot-annotation steps into a `references/` file, keeping SKILL.md as an overview that links to them, to improve progressive disclosure.

Trim definitional asides (e.g., 'HAR (HTTP Archive) files are JSON dumps of network traffic...') that assume knowledge Claude already has.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and action-oriented, but there is redundancy: the relationship to other skills is restated across §9 'Pairing with Other Skills', 'Notes on usage', and 'Related Skills & Chains', and minor asides like the HAR one-liner ('HAR (HTTP Archive) files are JSON dumps...') could be trimmed.	4 / 5
Actionability	Provides copy-paste-ready, executable guidance: a full `sanitize_har` jq function, a `credentials: 'include'` fetch PoC pattern, OS-specific black-bar steps, pre/post-capture checklists, and concrete filename conventions.	5 / 5
Workflow Clarity	Multi-step processes are explicitly sequenced with validation checkpoints — the 5-screenshot PoC pattern, pre-screenshot and post-capture checklists, and §4.3 'Verify before attaching' grep feedback loop — giving clear error-recovery paths for an irreversible-ish redaction workflow.	5 / 5
Progressive Disclosure	Well-organized into 9 numbered sections with clear headers and a single self-contained file; however no bundle files exist and some reference-grade material (detailed jq filters, per-OS annotation steps) is inlined rather than split out, leaving minor organization gaps.	4 / 5
	Total	18 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states what the skill does and when to use it, with natural trigger terms and a distinct niche. It does not pad with generic language and stays in an acceptable imperative-third-person voice.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'cookie redaction protocol', 'PII black-bar discipline', 'HAR file sanitization (jq filters...)', 'Burp Repeater/Intruder screenshot hygiene', 'DevTools Console PoC patterns', 'filename conventions', 'post-submission rotation hygiene' — with comprehensive coverage of the skill's scope.	5 / 5
Completeness	Explicitly answers both 'what' (evidence-capture and PoC-redaction discipline with enumerated sub-tasks) and 'when' via concrete triggers: 'Use BEFORE any PoC screenshot, BEFORE attaching a HAR, or whenever preparing evidence with session cookies or other-user PII.'	5 / 5
Trigger Term Quality	Natural operator vocabulary is well covered: 'PoC screenshot', 'HAR', 'session cookies', 'other-user PII', 'bug-bounty submissions', 'evidence', plus tool-specific terms (Burp, DevTools); these are phrases a user would actually say when reaching for this skill.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (redaction/sanitization hygiene layer) and explicitly distinguishes itself from paired skills ('Pairs with bugcrowd-reporting and report-writing'), minimizing the chance of triggering for report-body or VRT tasks.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/evidence-hygiene/SKILL.md
Commit: 58017df

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.