What problem does it solve? Bug bounty hunters often waste time writing reports for findings that get rejected as N/A, duplicates, or out-of-scope, hurting their validity ratio and reputation. This Skill runs a structured validation pass on a finding before any report is written, killing weak findings early. ## Core Features & Use Cases - 7-Question Gate: Checks demonstrability, program acceptance, scope, privilege requirements, known behavior, provable impact, and the never-submit list — one wrong answer kills the finding. - 4 Pre-Submission Gates: Verifies real HTTP reproduction, concrete attacker impact, deduplication against disclosed reports, and report quality (title formula, CVSS, fix recommendation). - Chain Evaluation: Determines whether a conditionally valid finding (open redirect, DNS-only SSRF, clickjacking) can be chained into a reportable impact. - Use Case: After confirming a possible IDOR on an endpoint, run /validate to confirm the response actually exposes another user's private data, check Hacktivity for duplicates, and get a PASS before writing the report. ## Quick Start Run /validate and describe your finding including the endpoint, bug class, what the PoC shows, and the target program to receive a PASS, KILL, or DOWNGRADE verdict.
