CtrlK
BlogDocsLog inGet started
Tessl Logo

report-writing

Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Validation gates and the submittability/always-rejected decision are owned by triage-validation; this skill owns the written report itself (templates, tone, formulas). Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.

64

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/report-writing/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable, copy-paste-ready report templates and scoring tables make this a strong operational skill, but it pays for it in length and structure: it is a single inlined monolith with no progressive disclosure, and the report-writing flow lacks an explicit validation feedback loop beyond the pre-submit checklist.

Suggestions

Split the four platform templates (H1/Bugcrowd/Intigriti/Immunefi) and the CVSS 3.1/4.0 references into one-level-deep reference files, leaving the SKILL.md as a routing overview with "See PLATFORM.md" links — this directly raises progressive_disclosure.

Add an explicit numbered writing workflow with a validation checkpoint (draft → run pre-submit checklist → fix gaps → re-verify severity matches impact → submit) so the feedback loop is explicit rather than implied by the checklist.

Trim the operator-notes prose ("What triagers actually read", the CVSS-vs-VRT narrative) to the highest-signal bullets; the re-explanation of how triagers read reports competes with the context budget.

DimensionReasoningScore

Conciseness

The body is mostly lean and earns its tokens (formula, templates, tables), but it re-explains some platform basics (e.g. the "What triagers actually read" reading-sequence and the CVSS-vs-VRT disagreement narrative) that assume less than Claude's competence, so it sits just below the fully-lean score-5 anchor.

4 / 5

Actionability

Provides copy-paste-ready templates for all four platforms, executable HTTP/Solidity PoC blocks, a concrete CVSS metric table, and a runnable fix snippet (`if order.user_id != current_user.id: raise Forbidden()`) — fully executable guidance covering the common cases, matching the score-5 anchor.

5 / 5

Workflow Clarity

The 60-second pre-submit checklist and severity self-assessment act as validation checkpoints, but the report-writing process itself is presented as parallel templates rather than a sequenced workflow with explicit validate→fix→retry loops; per the rubric, a writing skill without an explicit validation feedback loop is capped at 3.

3 / 5

Progressive Disclosure

No bundle files exist and the SKILL.md is a ~560-line monolith inlining four full platform templates, two CVSS references, and an operator-notes layer that should live in separate reference files; references are absent and structure is buried, fitting the score-2 anchor (content that belongs in separate files is inlined).

2 / 5

Total

14

/

20

Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A rich, specific description that clearly states what the skill does and when to use it, with platform keywords and an explicit scope boundary against a sibling skill. It is slightly long and could trim a couple of the capability phrases without losing trigger value.

Suggestions

Tighten the capability list — nine comma-separated items dilute the trigger; consolidate to the four or five highest-signal phrases (templates, impact-first writing, CVSS scoring, pre-submit checklist).

Move the sibling-skill boundary clause to the body; in the description a single "owns the written report; not triage decisions" clause is enough.

Add the natural verb "writing a bug bounty report" near the front so a user phrasing the request in plain terms lands on this skill.

DimensionReasoningScore

Specificity

Enumerates many concrete capabilities ("report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist") — several specific actions with only minor coverage gaps, matching the score-4 anchor rather than the comprehensive score-5 list.

4 / 5

Completeness

Explicitly answers both what (templates, tone, formulas, scoring) and when ("Use after validating a finding and before submitting") with concrete trigger phrasing, matching the score-5 anchor that requires both a clear what and an explicit when.

5 / 5

Trigger Term Quality

Includes natural user-facing phrases ("bug bounty report writing", "CVSS 3.1 scoring", "pre-submit checklist") and platform names (H1/Bugcrowd/Intigriti/Immunefi); good keyword coverage but a few natural synonyms a triager might say ("triage response", "severity justification") are absent, fitting score 4.

4 / 5

Distinctiveness Conflict Risk

The ownership boundary ("owned by triage-validation; this skill owns the written report itself") carves a distinct niche and lists platform-specific triggers, giving mostly-distinct scoping; minor overlap risk with sibling reporting skills keeps it at 4 rather than 5.

4 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (568 lines); consider splitting into references/ and linking

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.