bb-methodology

Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next. Master orchestrator that combines the 5-phase non-linear hunting workflow with the critical thinking framework (developer psychology, anomaly detection, What-If experiments). Routes to all other skills based on current hunting phase. Also use when asking "what should I do next" or "where am I in the process."

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

73%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable content with strong workflow sequencing and validation checkpoints for a destructive/batch-adjacent domain. The main weakness is progressive disclosure: many referenced scripts/docs are absent from the bundle and large reference-style tables are inlined.

Suggestions

Ship the referenced bundle files (tools/*.py, tools/*.sh, docs/auth-sessions.md) so the navigation signals resolve to real material, or remove the references if the tools are external.

Move the large Tool Routing by Phase table and per-vuln-class checklists into a one-level-deep reference file, keeping SKILL.md as a concise overview that points to it.

Trim sections that restate widely-known concepts (amateur vs pro, asymmetry principle) to reduce token cost without losing the skill-specific signal.

Dimension	Reasoning	Score
Conciseness	Mostly efficient tables and checklists, but the body is large (~400 lines) with some sections restating general hunting concepts Claude likely knows (amateur vs pro, asymmetry principle); could be tightened without losing signal.	3 / 5
Actionability	Fully executable guidance throughout: concrete commands (`/recon target.com`, `python3 tools/lead_board.py ingest`), decision trees with specific payloads (`{{7*7}}`, `SLEEP(10)`), and tool routing tables covering common cases.	5 / 5
Workflow Clarity	Clear 5-phase non-linear sequence with explicit validation checkpoints (7-Question Gate, pre-report gate 'Any fail? -> KILL the finding'), feedback loops (rotate rules, re-test for bypass), and checklists for session start/end.	5 / 5
Progressive Disclosure	The body references bundle files (`docs/auth-sessions.md`, `tools/lead_board.py`, `tools/bypass_403.sh`, etc.) that do not exist in the bundle, and inlines substantial content (phase checklists, tool tables) rather than splitting it into referenced files; navigation signals point to missing material.	2 / 5
	Total	15 / 20 Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with explicit trigger guidance, concrete capabilities, and clear what/when coverage. It uses third person and natural trigger phrases, distinguishing itself as an orchestrator skill.

Dimension	Reasoning	Score
Specificity	Names concrete capabilities ('5-phase non-linear hunting workflow', 'critical thinking framework', 'Routes to all other skills based on current hunting phase') with only minor coverage gaps.	4 / 5
Completeness	Explicitly answers both 'what' (master orchestrator combining workflow + critical thinking framework) and 'when' (multiple concrete trigger clauses with 'Use at...' and 'Also use when...').	5 / 5
Trigger Term Quality	Comprehensive natural trigger phrases including 'at the START of any bug bounty hunting session', 'when switching targets', 'what should I do next', and 'where am I in the process' that users would naturally say.	5 / 5
Distinctiveness Conflict Risk	Clearly niched as a master orchestrator that routes to other skills, with distinct triggers ('where am I in the process'); minor overlap risk with adjacent hunting skills it routes to.	4 / 5
	Total	18 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: shuvonsec/claude-bug-bounty
Path: skills/bb-methodology/SKILL.md
Commit: 0826b13

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.