vuln-report-writing SKILL.md skillA
vuln-report-writing from hellodqy/mastermind-bug-bounty is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add hellodqy/mastermind-bug-bounty/vuln-report-writing@git:20260916.a5be4e5Pins git:20260916.a5be4e5 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- hellodqy/mastermind-bug-bounty
- Path
skills/vuln_report_writing/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260916.a5be4e5, committed Sep 16, 2026
- Size
- 2,285 bytes
- Repository stars
- 14
- License
- none declared
Write submission-ready vulnerability reports from verifier-confirmed findings. Use whenever Mastermind enters Phase 3 or is otherwise asked to draft, rewrite, polish, or format a vulnerability report; do not use during recon or testing.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Vulnerability Report Writing ## Goal 把 Verifier 确认的漏洞整理成审核人员仅凭报告即可独立复现、证据链完整且不夸大影响的提交稿。 ## Required Inputs - 已确认漏洞及其授权边界、根因和实际影响 - 具体资产、端点、完整 raw HTTP 请求和关键响应证据 - 从资产/接口来源到影响验证的完整轨迹 - 截图或截图占位说明、合规边界及修复方向 ## Workflow 1. 先从 findings、evidence、worklog 和现有产物补齐输入；未知内容保留明确的 `[待补充]`，不得编造。 2. 必读 `references/vuln-report-writing.md`，按其中的黄金攻击链、raw 数据包、图位和文风规范成稿。 3. 使用 `skills/vuln_report_writing/templates/report_template.md` 作为默认结构；目标平台有官方章节名时映射到官方模板，但仍保留本 Skill 的证据与复现要求。 4. 最终执行证据、影响、脱敏、可复现性和合规边界检查。 ## Constraints 1. 只为 Verifier 确认且已证明实际安全影响的漏洞生成报告；PENDING、INFO、失败线索和负面结果不得进入正文或附录。 2. 最终 PoC 优先给完整 Burp/raw HTTP 请求，不用 curl 替代；关键请求头和 body 不得省略，响应以关键回显摘录或截图证据呈现。 3. 复现过程必须从资产或接口来源开始，按“动作 → 结果 → 证据”写到影响验证，第三方应能顺序复现。 4. 每项影响必须有证据支持；不得推测数据规模、权限、可利用性或危害等级。 5. 敏感数据必须脱敏，并明确只读/最小化验证、未执行动作及还原情况。 ## Output Contract 默认输出：标题、漏洞摘要、受影响资产、复现手册、附件 POC、风险影响评估、修复建议。正文使用中文；HTTP 数据包、字段名、路径和技术术语保持原样。
Read the whole file at its exact version.
How to install
mdr add hellodqy/mastermind-bug-bounty/vuln-report-writing@sha256:691e061a8de96abaThe line at the top of this page pins the label git:20260916.a5be4e5, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_lav4yxirguslonup)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 16, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (2285 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
hellodqy/mastermind-bug-bounty · 14 stars · license none declared · pushed 2026-09-16 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_lav4yxirguslonup GET https://markdownregistry.com/api/v1/resolve?ref=hellodqy/mastermind-bug-bounty/vuln-report-writing GET https://markdownregistry.com/api/v1/blob/691e061a8de96aba3ccc20c0100dae0e259737d7d1f8052eeb68ee686b4e7f32
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from hellodqy/mastermind-bug-bounty
Every file in hellodqy/mastermind-bug-bounty