name: bug-bounty-triage description: "Bug bounty report triage, validation, and severity escalation. Use when the user provides a bug bounty report to validate, wants to check if a finding is submittable, needs to escalate severity for maximum payout, or says 'triage this', 'validate this report', 'escalate this', 'is this submittable', 'check this bounty report', 'max bounty', or 'will this get accepted'." argument-hint: "<bug bounty report, vulnerability description, or target URL + finding>" allowed-tools: [Read, Glob, Grep, Bash, Write, Edit, Agent, WebFetch, WebSearch]

Bug Bounty Report Triage, Validation & Severity Escalation

Act as a rigorous bug bounty triager. For triage, validation, or escalation, test the finding yourself where the target is accessible and the testing is authorized. A skill invocation does not grant blanket permission to test a target. Distinguish observed results from inferences and untested possibilities.

Your goals:

1. Test it yourself — Independently reproduce the complete exploit and its effect end to end where applicable.
2. Assess — Is the finding reproducible, meaningful, and supported well enough to submit?
3. Escalate — Pursue the highest real, defensible impact and severity.
4. Ship — Output a clean, copy-paste-ready report file. No fluff.

REPORT AUDIENCE AND INFORMATION DENSITY

Write for a technically capable security triager who understands HTTP, curl or Burp, browser developer tools, redirects, JSON, and common vulnerability concepts. Do not teach standard security tooling or narrate routine actions. Assume the triager has no prior knowledge of the target product, its role model, the affected feature, the reporter's lab, or any custom infrastructure used by the PoC.

• Explain only the product-specific and lab-specific facts needed to reproduce the issue.
• Prefer exact commands, requests, short scripts, paths, and expected outputs over explanatory paragraphs.
• Remove repetition, not operational detail. Reproduction completeness takes priority over brevity.
• A capable triager must not need to guess a target-specific step, invent custom infrastructure, or ask where a required value comes from.

$ARGUMENTS

PHASE 1: INTAKE

Extract from the provided report:

• Target: domain, app, API
• Vuln class: CWE (IDOR, XSS, SSRF, SQLi, Auth Bypass, etc.)
• Endpoint: URL, route, parameter
• Claimed severity: Critical / High / Medium / Low
• PoC: steps, requests, payloads
• Claimed impact: what the reporter says happens
• Program (if supplied): platform, program name, relevant constraints
• Target-specific prerequisites: product version/build, feature location, required role, and how required authentication values are obtained
• Custom test infrastructure: network placement, listeners/services, commands or scripts, ports, and replaceable values

If information needed for a live test is missing, continue analyzing the supplied evidence and ask only for the specific missing input.

SOURCE FIDELITY — NEVER REDACT

The supplied report and evidence are authoritative. Preserve every supplied value exactly in triage deliverables and submission reports unless the user explicitly requests a specific redaction in the current request.

• Never redact, sanitize, anonymize, pseudonymize, generalize, omit, or replace supplied secrets or evidence. This includes passwords, cookies, private keys, API keys, client IDs, client secrets, bearer or session tokens, OAuth codes, names, email addresses, usernames, IP addresses, hostnames, identifiers, hashes, request values, response values, and PII.
• Never introduce placeholders such as <REDACTED>, <TOKEN>, <SECRET>, <ID>, [redacted], or synthetic examples when the source contains the concrete value. Preserve a placeholder only when it already exists in the user's source or the user explicitly requests it.
• Treat redaction permission as limited to the exact values and report named by the user. Do not carry it into another report, artifact, or later request.
• Preserve exact values captured during authorized live validation when they are used as report evidence. Do not weaken a runnable PoC by replacing credentials, identifiers, request bodies, or response data with non-executable placeholders.
• If an applicable rule prevents transmitting a value, stop before writing or modifying the external report and identify the exact blocked value. Never silently substitute a placeholder or reduced example.

Before delivering a report, compare it with the supplied source and validation evidence. Treat any agent-created redaction marker or missing concrete value as a blocking error and restore the original value before continuing.

PHASE 2: LIVE END-TO-END TESTING (WHEN APPLICABLE AND AUTHORIZED)

For triage, validation, escalation, or submission-readiness requests, treat the supplied report as a lead, not proof. When the target is accessible and testing is authorized, independently reproduce the finding end to end: establish the starting state, execute the exploit, and verify the resulting data access or state change. Do not stop at reading the report, replaying one request without checking its effect, or accepting its screenshots and claims at face value. If end-to-end testing is not applicable or cannot be completed, explain why, assess the evidence available, and identify exactly what remains unverified. Do not claim a test occurred when it did not.

2a. Set Up Test Infrastructure

Create disposable test accounts using agent-email:

agent-email create

Register accounts on the target using either agent-browser or the in-app browser. Open the signup page, fill the form, and capture the resulting account state with the browser you chose. Neither browser is required over the other.

Poll for verification emails and complete registration:

agent-email read default --wait 30 --interval 2
agent-email show default <messageId>

Open the verification link in the chosen browser and complete account setup.

Create the accounts you need:

• IDOR/BOLA: attacker account + victim account
• Privilege escalation: low-priv + high-priv accounts
• Access control: accounts with different roles
• Auth bugs: at least one valid account

2b. Reproduce the Vulnerability

Independently execute the reported PoC against the live target using agent-browser or the in-app browser, whichever is available and effective for the target. Adapt the steps where necessary to establish whether the underlying flaw actually exists.

• Start with controlled accounts or records and the required attacker/victim roles when applicable
• Execute the complete path from trigger through observable impact, not just the triggering request
• For state changes, compare before and after state; for data exposure, verify unauthorized access to the actual data; for chains, verify each link
• Check a relevant control when feasible so expected behavior is distinguishable from the vulnerability
• Capture screenshots or browser state at the decisive steps using the chosen browser
• Record the HTTP requests/responses that prove exploitation when the PoC depends on them

# For API-level testing, use curl/httpie directly
curl -s -X POST <endpoint> -H "Authorization: Bearer <token>" -d '<payload>' | head -100

If the PoC fails:

• Adapt it — try variations, different parameters, encoding changes
• Check if it was patched — test adjacent endpoints for the same bug class
• If truly dead, stop and tell the user it's not reproducible

2c. Capture Evidence

Save the decisive screenshots or browser state through whichever browser you used. Save relevant HTTP exchanges and response data separately when they prove the finding. Include the decisive evidence in the report or attach it so the triager can access it.

When the PoC depends on custom infrastructure, also preserve the minimal runnable command or script used to create it, its required network placement, and the log output that proves the target reached it. A description such as "configure a listener" is not reproducible setup.

PHASE 3: SUBMISSION READINESS

If the report fails this gate, STOP. Tell the user not to submit.

Auto-Reject — ANY of these = DO NOT SUBMIT:

• Informational only (missing headers, version disclosure, verbose errors with no data leak)
• Best practice violation without exploit (missing rate limit, missing CSP with no XSS)
• Self-XSS with no delivery vector
• Clearly outside scope under constraints the user has supplied
• Requires victim to do unrealistic things (install malware, paste into console)
• Scanner output with no manual validation
• Theoretical — no working PoC, "could potentially" language
• Already patched / public CVE
• DoS via resource exhaustion (unless catastrophic)
• Missing SPF/DKIM/DMARC
• Clickjacking on non-state-changing pages
• CSRF on logout or non-sensitive actions
• Open redirect without chain
• Host header injection without cache poisoning PoC
• User enumeration alone (unless program explicitly accepts it)

Reproduction-Completeness Gate

A supported vulnerability is not yet submission-ready if a capable triager would have to guess any non-standard setup or target-specific step. Mark it YELLOW until the report includes, where applicable:

• the exact affected product version/build and feature location;
• the minimum required role and a compact explanation of any product-specific role name or numeric role ID;
• how to obtain each target-specific token, cookie, identifier, or other required value;
• the placement and reachability requirements for custom test hosts;
• the shortest runnable command or script for custom listeners or services;
• the decisive request, response, service log, and success condition; and
• a clear indication of which addresses and values the triager must replace with their own.

Do not add tutorials for standard tools. Supply the missing operational fact in the smallest useful form: usually one sentence, one command, or one evidence block.

Verdict

• GREEN: Independent end-to-end testing confirms the vulnerability and impact, with a solid PoC. Proceed.
• YELLOW: Testing is partial, impact is borderline, or an important link remains unverified. Continue testing or strengthen the evidence.
• RED: Current evidence does not support submission. Tell the user why and what would need to change.

Do not require a program-policy lookup or treat an inaccessible private program policy as a blocker. Apply relevant scope or reporting constraints only when the user has supplied them or they are otherwise already known.

PHASE 4: ESCALATION (MAXIMIZE BOUNTY)

For every confirmed finding, systematically pursue the maximum defensible impact. Check whether the flaw reaches more valuable data or actions, broader user or tenant scope, higher privileges, persistent access, or a credible chain to a larger outcome. Prioritize the strongest plausible paths, test them within the available authorization, and stop when further escalation is unsupported or would require access beyond that authorization. Clearly separate confirmed impact, strongly supported inference, and untested possibilities. Never increase severity by assertion alone.

4a. Escalation Paths by Vuln Class

Test these systematically using agent-browser or the in-app browser, plus direct HTTP requests where useful:

IDOR / BOLA

• Read-only → Read+Write (try PUT/PATCH/DELETE with other users' IDs)
• Single record → Broader access (use a bounded set of controlled records to assess whether the pattern generalizes)
• User data → Admin data (try admin-level resource IDs)
• Same-tenant → Cross-tenant (try org/tenant ID swaps)
• Check if PII/financial data exposed (regulatory impact: GDPR, HIPAA, PCI)

XSS

• Reflected → Stored (inject into fields that persist)
• Alert box → Access to session data or privileged actions (demonstrate with a controlled test account)
• Session access → Full ATO (prove with controlled accounts when possible)
• User context → Admin context (trigger XSS as admin user)
• XSS → CSRF bypass (use XSS to perform privileged actions)

SSRF

• External → Internal (hit 127.0.0.1, 169.254.169.254, internal hostnames)
• HTTP only → File read (file:///etc/passwd)
• Cloud metadata → Credential exposure (confirm only to the extent authorized)
• Internal service → RCE (chain with unauthenticated internal services)

SQL Injection

• Single column → Broader database access (use bounded queries and controlled records)
• Read → Write (INSERT, UPDATE via stacked queries)
• Data extraction → File read/write (LOAD_FILE, INTO OUTFILE)
• Data extraction → RCE (xp_cmdshell, UDFs)

Auth Bypass

• Single account → Any account
• User accounts → Admin accounts
• Auth bypass → Persistent access (demonstrate with a controlled test account)
• Auth bypass → MFA bypass

Privilege Escalation

• User → Admin
• Read-only → Read-write
• Single function → Full admin panel
• Can you modify security settings (disable MFA, change passwords)?
• Cross-tenant access?

Open Redirect

• Standalone → Chain with OAuth token theft (redirect_uri manipulation)
• Chain with SSO flows → ATO
• Test javascript: and data: URI schemes

File Upload

• Image → Web shell (test extension bypass, content-type manipulation)
• Upload → Path traversal (directory traversal in filename)
• SVG upload → Stored XSS

4b. Chaining

Combine findings for compound impact — test each chain live:

1. Info disclosure + IDOR → Proven full exploitation with real IDs
2. Open redirect + OAuth → Token theft → ATO
3. XSS + CSRF → Privileged action execution
4. SSRF + Cloud metadata → Cloud infrastructure takeover
5. Race condition + Financial endpoint → Double-spend / balance manipulation
6. Any bug + Admin access → Maximum impact demonstration

4c. CVSS Rescoring

After testing escalation paths, calculate the highest CVSS 3.1 score supported by the actual exploit chain and prerequisites. Set each metric from the evidence: authentication needed for the chain affects PR, a victim opening stored XSS generally affects UI, and cross-tenant access alone does not establish changed Scope. Assign high confidentiality, integrity, or availability impact only when the demonstrated reach warrants it. Explain any severity claim that depends on a strongly supported inference.

PHASE 5: GENERATE SUBMISSION REPORT

Write a file called <target-domain>-<vuln-type>.md in the current working directory. For example: example-com-idor.md, api-target-io-ssrf.md, app-victim-com-stored-xss.md. Derive the name from the target domain (dots replaced with dashes) and the vulnerability class. This is the final deliverable — a clean, copy-paste-ready report for the bug bounty platform.

The report must be:

• Straight to the point — No filler, no "I discovered", no narrative storytelling
• Evidence-heavy — Every claim backed by request/response or screenshot
• Max impact framing — Lead with the worst-case proven impact
• Self-contained and platform-ready — A triager can understand and reproduce it without access to the researcher's lab or local files

Submission-only file: The report file must contain only text the user can paste directly into the bug bounty submission. Keep internal triage analysis, submission advice, confidence ratings, program-policy discussion, research notes, warnings, and commentary to the user outside the report file. Do not add meta sections such as "Triage Context," "Analyst Notes," or "Potential Escalation." Do not include hypothetical impact from a different environment as though it were observed. When a fact limits the actual finding or severity (for example, the tested instance is a demo), state that fact briefly in the relevant Summary or Impact sentence and adjust the claim; never hide a material limitation or append an internal warning block.

Report Template

Use this structure as applicable. Keep setup, execution, and proof together so the report does not repeat the same evidence in separate Steps and PoC sections:

## [Specific Vulnerability Title Showing Max Impact]

**Severity**: [Critical|High|Medium|Low] (CVSS 3.1: X.X)
**CVSS Vector**: `CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X`
**CWE**: CWE-XXX — [Name]
**Asset**: `[affected URL/endpoint]`

### Summary

[2-3 sentences max. What's broken, what an attacker gets. Lead with impact.]

### Reproduction

Prerequisites: [In one compact paragraph or list, identify the affected version/build, required role, feature location, authentication source, network placement, and replaceable values. Omit facts that are obvious to a security triager.]

Setup: [If custom infrastructure is required, provide the shortest runnable commands or script and the expected startup indication. Omit this label when no custom setup is needed.]

1. [Perform one exact target-specific action. Include the request or command at the step where it is used.]
2. [Show the relevant response or log immediately after the action that produces it.]
3. [State the success condition in one sentence, including expected secure behavior versus the observed result.]

` ` `http
[Raw HTTP request or curl command]
` ` `

` ` `http
[Response proving exploitation]
` ` `

### Impact

[Bullet points. What an attacker achieves. Business terms.]

- [Primary impact — the worst thing that happens]
- [Secondary impact — scope, scale, affected users]
- [Regulatory/compliance impact if applicable]

### Remediation

[1-3 bullet points. Specific fix. No essays.]

- [Primary fix]
- [Alternative mitigation if applicable]

Report Rules

1. Title: State the strongest demonstrated impact plainly. For example, use "IDOR in invoice API exposes other tenants' invoices" when the evidence shows that access.
2. Precise claims: Use direct language for proven behavior. Label plausible but untested consequences as inferences; do not use certainty to disguise missing proof.
3. No self-references: No "I found", "I tested", "during my research". Just state the facts.
4. Assume security competence, not target familiarity: Do not explain standard tools or concepts. Do explain the target's feature location, product-specific roles, authentication-value source, custom network placement, and any non-obvious prerequisite in the shortest useful form.
5. Setup must be executable: "Configure a listener," "set up a server," or similar prose is insufficient when the PoC depends on custom infrastructure. Provide the minimal runnable command or script, or name an exact attachment and show how to run it.
6. Placeholders must be actionable: For every value the triager must replace, state what it represents and where to obtain it. Do not explain obvious substitutions repeatedly.
7. Keep proof beside the action: Put decisive requests, responses, and logs directly in the numbered reproduction flow. Do not repeat them in a separate PoC section or restate them in prose.
8. Steps must not hide work: Use one numbered action per step when combining actions would make the reader infer missing setup or verification. Replace vague directions such as "authenticate," "capture," or "confirm" with the exact target-specific action.
9. Impact section leads with the strongest supported escalated impact, not the base finding. Mark an inference as an inference; never present an untested chain as demonstrated.
10. Be concise without a word limit: Remove filler, generic transitions, tutorial text, and repeated evidence. Keep every non-obvious detail needed to reproduce and assess the finding. Prefer a command or evidence block to a paragraph.
11. Make evidence accessible: Include decisive request/response excerpts and observations in the report. If an attachment is needed, identify it by the exact attached filename and explain what it proves. Do not rely on local file paths, private lab URLs, or unexplained references unavailable to the triager.
12. Never redact supplied evidence: Preserve every supplied password, cookie, key, token, credential, identifier, name, email address, IP address, PII value, request value, and response value exactly. Do not replace concrete values with placeholders unless that placeholder already appears in the source or the user explicitly requested the exact redaction.
13. Request format: Raw HTTP and curl are equally acceptable. Choose the format that lets the triager reproduce the request most easily; include headers, body, cookies or authentication setup, and substitutions needed for that format.
14. Paste test before delivery: Read the entire report file as if selecting all and pasting it into the submission form. Remove template brackets, drafting instructions, internal caveat blocks, status labels, analyst commentary, local file references, escaped Markdown syntax, HTML spacing entities, and any outer code fence around the report. Keep only submission content and code fences needed for commands, requests, responses, or logs.
15. Source-fidelity test before delivery: Compare the completed report against the supplied report and captured evidence. Confirm that every concrete credential, secret, identifier, URL, hash, command argument, request body, response excerpt, PII value, and negative control remains verbatim and that no new redaction marker was introduced.

Knowledge-Assumption Audit

Before delivery, read only the submission file as a capable triager unfamiliar with the target and the reporter's lab. Block delivery if any answer is no:

• Can the reader obtain every required product-specific value from the report?
• Can the reader create every custom listener or service without inventing code or configuration?
• Is the required role, feature location, and network placement clear without product research?
• Does each decisive action have an adjacent success signal in a response, log, or state check?
• Can the reader distinguish fixed evidence values from values they must replace?
• Has duplicated explanation been removed while all non-obvious operational detail remains?

If essential information is missing from the supplied evidence and cannot be established during authorized testing, do not invent it or pad the report with prose. Mark the report not ready and request the exact missing detail.

Write the report to <target-domain>-<vuln-type>.md using the Write tool. Tell the user the filename and give a brief summary of what's in it.

PHASE 6: TRIAGE DECISION

After writing the report, present this summary to the user in chat only. Never append it, or any other internal assessment, to the submission report file:

TRIAGE DECISION
═══════════════
Tested:      [YES — independently reproduced end to end / PARTIAL — specify verified steps / NO — assessed supplied evidence]
Validation:  [CONFIRMED / PARTIALLY CONFIRMED / UNVERIFIED / NOT REPRODUCIBLE]
Submission:  [GREEN / YELLOW / RED]
Severity:    [Original] → [Escalated]
CVSS:        X.X — CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X
Confidence:  [HIGH / MEDIUM / LOW]
Action:      [SUBMIT / STRENGTHEN / DO NOT SUBMIT]
Bounty Est:  [$range]
Report:      <target-domain>-<vuln-type>.md (ready to copy-paste)

If RED: explain what's wrong and what would fix it. If YELLOW: explain what's borderline and whether escalation helped. If GREEN: tell them to submit.

RULES

1. Independently test end to end when applicable. For triage, validation, or escalation, reproduce the whole exploit and verify its effect within the authorization available. Never label a finding confirmed or submission-ready solely because the supplied report says it works. If live testing is unavailable or incomplete, report that limit and the precise steps left unverified.

2. Never submit a report you wouldn't bet the account on. One N/A closure can lead to a ban. When in doubt, don't submit.

3. Escalation is not fabrication. Only claim impact you proved or that logically follows from confirmed behavior.

4. Use disposable accounts. Create fresh test accounts via agent-email. Create multiple accounts when you need attacker/victim pairs.

5. The report file is the deliverable for a submission-ready finding. Output <target-domain>-<vuln-type>.md (e.g. example-com-idor.md) when the evidence supports submission. It must be copy-paste ready. For a finding that does not reproduce or lacks essential proof, state what is missing instead of dressing it up as a ready report.

6. Max impact, honest framing. Pursue every credible escalation path that could materially change severity, including privilege, tenant scope, write access, persistence, and chaining. Seek the absolute highest severity the evidence supports. Frame the result in business terms and state the proof for each step.

7. Dense reports win. Triage teams skim. Front-load impact, use executable evidence instead of narration, and remove repetition. Never shorten a report by omitting a non-obvious prerequisite, target-specific action, value source, or success condition.

8. One vuln per report unless bugs chain together for compound impact.

9. If it doesn't reproduce, say so immediately. Don't waste time polishing a dead finding.

10. Save evidence as you go. Screenshots, HTTP logs, and response data can support your work. Put decisive proof in the report itself or attach it in a form the triager can access; local artifacts alone are not evidence for the recipient.

bug-bounty-triage

bug-bounty-triage is an agent skill for rigorous bug bounty report triage, independent validation, impact escalation, and submission-ready reporting.

It is designed to help an agent:

• reproduce findings end to end when testing is authorized;
• separate observed evidence from inference;
• reject weak or non-actionable reports before submission;
• pursue the highest defensible impact without overstating severity; and
• produce concise, evidence-heavy Markdown reports for bug bounty platforms.

Responsible use

Use this skill only on systems you own or are explicitly authorized to test. Invoking the skill does not grant permission to test a target, exceed a program's scope, access unrelated data, or perform destructive actions.

The skill may preserve sensitive evidence in generated reports when the user supplies it. Review generated files before sharing or committing them, and follow the applicable bug bounty program's rules.

Installation

Skills CLI

npx skills add Sequester-AG/bug-bounty-triage --skill bug-bounty-triage

Codex

git clone https://github.com/Sequester-AG/bug-bounty-triage.git ~/.codex/skills/bug-bounty-triage

Agent skills directory

git clone https://github.com/Sequester-AG/bug-bounty-triage.git ~/.agents/skills/bug-bounty-triage

Supporting skills and CLIs

The full live-validation workflow uses agent-browser for browser automation and agent-email-cli for disposable test inboxes.

Install both agent skills:

npx skills add https://github.com/vercel-labs/agent-browser --skill agent-browser
npx skills add https://github.com/zaddy6/agent-email-skill --skill agent-email-cli

The skills provide agent instructions. Install their corresponding command-line tools for live execution:

npm install -g agent-browser
agent-browser install
npm install -g @zaddy6/agentemail

Usage

Invoke the skill with a report, vulnerability description, or target and finding:

Use $bug-bounty-triage to validate this report and determine whether it is ready to submit: <report>

For live validation, provide the relevant authorization and scope. The complete workflow can use browser automation, direct HTTP requests, and disposable email accounts when those capabilities are available in the host environment. If live testing is unavailable, the skill should state what remains unverified.

Output

For a supported, submission-ready finding, the skill writes a Markdown report named from the target and vulnerability class, such as:

example-com-idor.md

Internal triage commentary stays outside the submission file.

Repository contents

• SKILL.md — skill metadata, workflow, validation gates, escalation guidance, and report format
• LICENSE — MIT License

License

MIT