submit

Agent Skills › H-mmer/pentest-agents › submit

submit

GitHub

用于起草并提交漏洞报告至赏金平台。读取范围与发现详情，生成格式化草稿供用户确认，审核通过后提交并更新状态。强调绝不硬编码凭证，必须经用户明确批准方可提交，确保合规与质量。

providers/codex/.agents/skills/submit/SKILL.md H-mmer/pentest-agents

Trigger Scenarios

用户请求提交漏洞报告需要向Bugcrowd或HackerOne等平台提交已验证的漏洞

Install

npx skills add H-mmer/pentest-agents --skill submit -g -y

More Options

Non-standard path

npx skills add https://github.com/H-mmer/pentest-agents/tree/main/providers/codex/.agents/skills/submit -g -y

Use without installing

npx skills use H-mmer/pentest-agents@submit

指定 Agent (Claude Code)

npx skills add H-mmer/pentest-agents --skill submit -a claude-code -g -y

安装 repo 全部 skill

npx skills add H-mmer/pentest-agents --all -g -y

预览 repo 内 skill

npx skills add H-mmer/pentest-agents --list

SKILL.md

Frontmatter

{
    "name": "submit",
    "description": "Draft and submit a vulnerability report to the bug bounty platform. Reads scope.yaml for platform\/program, uses brain + findings for content. Always drafts first for review."
}

Prepare and submit a report for finding: $ARGUMENTS

Workflow: 0. Read rules/identities.md to learn which env vars hold the researcher handle, email alias, and API token for the platform identified in step 1. NEVER hardcode a username or email; always reference the env-var symbol. If a required var is unset, abort with error: <VAR> is not set; refusing to guess and surface it to the user.

Read scope.yaml to determine the platform and program handle.
Read the finding details from brain/findings/poc directory matching "$ARGUMENTS".
Use MCP tool draft_report to create a platform-formatted draft:
- Format title as: [Vuln Type] in [Component] allows [Impact] via [Vector]
- Include CVSS vector string (CVSS 3.1 for HackerOne, CVSS 4.0 for all others)
- Map vulnerability type to platform-specific taxonomy (H1 weakness IDs, Bugcrowd VRT)
- Include all reproduction steps, impact, and remediation
Show the draft to the user and ASK FOR CONFIRMATION before submitting.
ONLY after explicit user approval, use MCP tool submit_report to submit.
After submission, update the brain: uv run python3 ../../tools/brain.py record <target> confirmed <technique> "Submitted as report #<id> on <platform>"
Update findings.json status to "reported".

IMPORTANT: NEVER submit without showing the draft and getting explicit user confirmation.

Top-Tier Submission Discipline

Submission is a controlled release.

Before asking for approval, verify:

/validate PASS or explicit accepted equivalent exists
/quality score is acceptable and blocking issues are fixed
/dupcheck result is included or intentionally skipped with reason
all evidence paths exist on disk
platform taxonomy, severity, and CVSS version match the platform
no secrets, customer data, or prohibited artifacts are over-shared
remediation is actionable and scoped to the root cause

Show the user the final title, severity, platform, target asset, evidence list, and any residual risk. If anything changed after draft generation, re-run quality before submission.