What problem does it solve? Security researchers waste time and damage their validity ratio by submitting findings that get closed as N/A or Informative. This Skill filters out invalid, out-of-scope, duplicate, or unprovable findings before any report is written, so only submission-ready bugs reach the report stage. ## Core Features & Use Cases - 7-Question Gate: Sequentially validates exploitability, program impact alignment, scope, access preconditions, novelty, demonstrable impact, and known-invalid bug classes — one wrong answer kills the finding. - 4 Pre-Submission Gates: Runs reality check, impact validation, deduplication search, and report quality checks before submission. - Never-Submit & Chain-Required Lists: Identifies always-rejected findings (missing headers, self-XSS, logout CSRF) and conditionally valid findings that need a full exploit chain (open redirect + OAuth theft, CORS + credential exfil). - CVSS 3.1 Reference & Pre-Severity Gate: Provides scoring examples and forces concrete impact justification before labeling any finding Critical or High. - Use Case: Before writing a HackerOne report for a suspected IDOR, run the 7-Question Gate to confirm you have a copy-pasteable HTTP request, real cross-user data in the response, and no duplicate in disclosed reports — then score it with the CVSS quick reference. ## Quick Start Ask the AI to run the triage-validation 7-question gate on your suspected finding, providing the HTTP request, response evidence, and the program's scope page.
