/validate
Validate a finding — runs 7-Question Gate + 4-gate checklist. Kills weak findings before report writing. Prevents N/A submissions that hurt validity ratio. Usage: /validate
$ npx -y skills add shuvonsec/claude-bug-bounty --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/validate
Context preview
What this command does when you run it.
Validate a finding — runs 7-Question Gate + 4-gate checklist. Kills weak findings before report writing. Prevents N/A submissions that hurt validity ratio. Usage: /validate
Command definition
validate.mddescription: Validate a finding — runs 7-Question Gate + 4-gate checklist. Kills weak findings before report writing. Prevents N/A submissions that hurt validity ratio. Usage: /validate
/validate
Run full validation on the current finding before writing a report.
What This Does
1. Runs 7-Question Gate (one wrong answer = kill it) 2. Checks against the always-rejected list 3. Runs 4 pre-submission gates 4. Outputs: PASS (write the report) or KILL (move on)
Usage
/validate
Describe the finding when prompted. Include:
- The endpoint
- The bug class
- What the PoC shows
- The target program
If you already ran the scanner, pass its `summary.json` with `--scanner-summary findings/<target>/summary.json` so the validation record captures the scanner tiering that led to this finding.
The 7-Question Gate
Answer each. ONE wrong answer = STOP.
Q1: Can I demonstrate this step-by-step RIGHT NOW?
Write this out:
1. Setup: I need [own account / another user's ID / no account]
2. Request: [exact HTTP method, URL, headers, body]
3. Result: Response shows [exact data / action completed]
4. Impact: Real consequence is [account takeover / PII exposed / money stolen]
5. Cost: Time: [X min], Capital: [$0 / $X]
If step 2 is "I need to look at the code more" → KILL IT.
Q2: Is the impact accepted by this program?
Check program scope page. Is your bug class listed? Is it excluded?
Q3: Is the vulnerable asset in scope?
Exact domain in scope? Not staging/dev? Not a third-party service?
Q4: Does it need admin or privileged access that an attacker can't get?
"Admin can do X" → KILL IT. "Regular user can do X that only admin should" → valid.
Q5: Is this known or documented behavior?
Search disclosed reports + changelog + API docs.
Q6: Can you prove impact beyond "technically possible"?
- XSS → actual cookie value in exfil request, not just alert()
- SSRF → response body from internal service, not just DNS callback
- IDOR → actual other-user's private data in response, not just 200 status
Q7: Is this on the never-submit list?
Missing headers, GraphQL introspection alone, clickjacking without PoC,
self-XSS, open redirect alone, SSRF DNS-only, logout CSRF, banner disclosure,
rate limit on non-critical forms, missing cookie flags alone...
If yes → KILL IT unless you have a chain.
Auth-related findings need cross-identity proof
For IDOR, BOLA, auth bypass, ATO, and privilege escalation:
- Session A must reach Session B's data or action
- A fresh session must still reproduce the result
- Anonymous vs authenticated behavior must be different
Blank identity answers fail automatically.
Check: Conditionally Valid?
If it's on the never-submit list, can you chain it?
| You Have | Chain Available? | |---|---| | Open redirect | + OAuth code theft → ATO? | | SSRF DNS-only | + internal service data? | | Clickjacking | + sensitive action + PoC? | | CORS wildcard | + credentialed data exfil? | | Prompt injection | + IDOR → other user's data? |
If no chain → KILL IT. If chain confirmed → report both together.
Common N/A Classes
Kill these before writing a report unless you have a proven chain or data delta:
- Reflected XSS without impact beyond alert-level proof
- SSRF DNS callback only
- IDOR on your own account
- SQLi error only, no data returned
- CORS wildcard without credentialed exfil
- Open redirect without token theft
- MFA no lockout without OTP bypass
- SAML metadata exposure without signature abuse
4 Gates — All Must Pass
**Gate 0 (30 sec):**
[ ] Confirmed with real HTTP requests (not just code reading)
[ ] In scope (checked program page)
[ ] Reproducible from scratch
[ ] Evidence captured
**Gate 1 — Impact (2 min):**
[ ] Can answer "What does attacker walk away with?"
[ ] More than "sees non-sensitive data"
[ ] Real victim exists
[ ] No unlikely preconditions
**Gate 2 — Dedup (5 min):**
[ ] Searched HackerOne Hacktivity for endpoint + bug class
[ ] Searched GitHub issues
[ ] Read 5 most recent disclosed reports
[ ] Not in changelog as known issue
**Gate 3 — Report quality (10 min):**
[ ] Title formula: [Class] in [Endpoint] allows [actor] to [impact]
[ ] Steps have exact HTTP request
[ ] Evidence shows actual impact
[ ] CVSS calculated
[ ] Fix: 1-2 concrete sentences
Output
**PASS:** "All 7 questions pass. All 4 gates pass. Proceed to /report."
**KILL:** "Q[N] fails because [reason]. Kill this finding. Reason: [explanation]. Move on."
**DOWNGRADE:** "Q6 only shows technical possibility. Downgrade from High to Medium. Requires showing actual data exfil in PoC."
Read more
description: Validate a finding — runs 7-Question Gate + 4-gate checklist. Kills weak findings before report writing. Prevents N/A submissions that hurt validity ratio. Usage: /validate
/validate
Run full validation on the current finding before writing a report.
What This Does
1. Runs 7-Question Gate (one wrong answer = kill it) 2. Checks against the always-rejected list 3. Runs 4 pre-submission gates 4. Outputs: PASS (write the report) or KILL (move on)
Usage
/validate
Describe the finding when prompted. Include:
- The endpoint
- The bug class
- What the PoC shows
- The target program
If you already ran the scanner, pass its `summary.json` with `--scanner-summary findings/<target>/summary.json` so the validation record captures the scanner tiering that led to this finding.
The 7-Question Gate
Answer each. ONE wrong answer = STOP.
Q1: Can I demonstrate this step-by-step RIGHT NOW?
Write this out:
1. Setup: I need [own account / another user's ID / no account] 2. Request: [exact HTTP method, URL, headers, body] 3. Result: Response shows [exact data / action completed] 4. Impact: Real consequence is [account takeover / PII exposed / money stolen] 5. Cost: Time: [X min], Capital: [$0 / $X]
If step 2 is "I need to look at the code more" → KILL IT.
Q2: Is the impact accepted by this program?
Check program scope page. Is your bug class listed? Is it excluded?
Q3: Is the vulnerable asset in scope?
Exact domain in scope? Not staging/dev? Not a third-party service?
Q4: Does it need admin or privileged access that an attacker can't get?
"Admin can do X" → KILL IT. "Regular user can do X that only admin should" → valid.
Q5: Is this known or documented behavior?
Search disclosed reports + changelog + API docs.
Q6: Can you prove impact beyond "technically possible"?
- XSS → actual cookie value in exfil request, not just alert()
- SSRF → response body from internal service, not just DNS callback
- IDOR → actual other-user's private data in response, not just 200 status
Q7: Is this on the never-submit list?
Missing headers, GraphQL introspection alone, clickjacking without PoC, self-XSS, open redirect alone, SSRF DNS-only, logout CSRF, banner disclosure, rate limit on non-critical forms, missing cookie flags alone...
If yes → KILL IT unless you have a chain.
Auth-related findings need cross-identity proof
For IDOR, BOLA, auth bypass, ATO, and privilege escalation:
- Session A must reach Session B's data or action
- A fresh session must still reproduce the result
- Anonymous vs authenticated behavior must be different
Blank identity answers fail automatically.
Check: Conditionally Valid?
If it's on the never-submit list, can you chain it?
| You Have | Chain Available? | |---|---| | Open redirect | + OAuth code theft → ATO? | | SSRF DNS-only | + internal service data? | | Clickjacking | + sensitive action + PoC? | | CORS wildcard | + credentialed data exfil? | | Prompt injection | + IDOR → other user's data? |
If no chain → KILL IT. If chain confirmed → report both together.
Common N/A Classes
Kill these before writing a report unless you have a proven chain or data delta:
- Reflected XSS without impact beyond alert-level proof
- SSRF DNS callback only
- IDOR on your own account
- SQLi error only, no data returned
- CORS wildcard without credentialed exfil
- Open redirect without token theft
- MFA no lockout without OTP bypass
- SAML metadata exposure without signature abuse
4 Gates — All Must Pass
**Gate 0 (30 sec):**
[ ] Confirmed with real HTTP requests (not just code reading) [ ] In scope (checked program page) [ ] Reproducible from scratch [ ] Evidence captured
**Gate 1 — Impact (2 min):**
[ ] Can answer "What does attacker walk away with?" [ ] More than "sees non-sensitive data" [ ] Real victim exists [ ] No unlikely preconditions
**Gate 2 — Dedup (5 min):**
[ ] Searched HackerOne Hacktivity for endpoint + bug class [ ] Searched GitHub issues [ ] Read 5 most recent disclosed reports [ ] Not in changelog as known issue
**Gate 3 — Report quality (10 min):**
[ ] Title formula: [Class] in [Endpoint] allows [actor] to [impact] [ ] Steps have exact HTTP request [ ] Evidence shows actual impact [ ] CVSS calculated [ ] Fix: 1-2 concrete sentences
Output
**PASS:** "All 7 questions pass. All 4 gates pass. Proceed to /report."
**KILL:** "Q[N] fails because [reason]. Kill this finding. Reason: [explanation]. Move on."
**DOWNGRADE:** "Q6 only shows technical possibility. Downgrade from High to Medium. Requires showing actual data exfil in PoC."
AI-powered bug bounty hunting from your terminal - recon, 20 vuln classes, autonomous hunting, and report generation. All inside Claude Code.
Repo: shuvonsec/claude-bug-bounty
Other commands on claude-bug-bounty.
- /arsenal
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from high-signal repos. Use to bootstrap a fresh box or audit which optional capabilities are wired in. Usage: /arsenal | /arsenal <tool-name>
Open command - /autopilot
Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]
Open command - /breach-check
HIBP k-anonymity check on a password wordlist. Enriches each password with its breach count, ranks DESC. Free API (no key), only first 5 chars of SHA-1 sent. Output -> <input>-ranked.txt. Usage /breach-check <wordlist> [--min-count N] [--max-count N] [--with-counts]
Open command - /bypass-403
Probe a 403/401 endpoint with the most-paid bypass tricks (header injection, path encoding, method swap, WAF fingerprint, vendor-specific). Wraps byp4xx when installed; otherwise runs a built-in matrix of 38+ techniques. Usage: /bypass-403 <url> | /bypass-403 -l <urls-file>
Open command - /chain
Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain
Open command - /cloud-recon
Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloud_enum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in DNS-history fallback). Use --keyword for storage discovery and --cf-bypass to find an origin IP behind CloudFlare. Usage:
Open command