bugbounty-workflow SKILL.md skillA
bugbounty-workflow from jensen-yao/agents-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add jensen-yao/agents-skills/bugbounty-workflow@git:20260815.3e2d588Pins git:20260815.3e2d588 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- jensen-yao/agents-skills
- Path
skills/bugbounty-workflow/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260815.3e2d588, committed Aug 15, 2026
- Size
- 8,560 bytes
- Repository stars
- 5
- License
- MIT
授权范围内(补天/SRC 等赏金平台)漏洞挖掘全流程工作流:侦察→挖掘→验证→报告。当用户要求"挖洞""挖漏洞""测目标""渗透测试""打点""提交SRC/补天"时使用。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Bug Bounty 全流程工作流 面向补天/SRC 等**授权范围内**的漏洞挖掘任务。按 5 个阶段推进:每阶段产出工件、与用户确认后再进入下一阶段。**严禁跳过阶段 0。** ## 铁律(全程有效,违反即终止任务) 1. **只测授权资产**:目标必须来自补天项目页、厂商授权等书面范围,范围外资产一律不测。 2. **不做破坏性测试**:禁止 DoS、删改数据、锁账号、高频扫描。 3. **数据最小化**:证明漏洞即可,禁止拖库/批量下载;SQL 注入用 `LIMIT 1` 或单次时间盲注确认。 4. **证据脱敏**:截图打码敏感信息;获取的敏感数据不落盘、不传播。 5. **报告真实**:不夸大等级;高危先报,未修复前不公开细节。 ## 工作目录约定 任务开始时在用户工作目录下创建: ``` bugbounty/ ├── 00-scope/scope.md # 授权与范围确认 ├── 01-recon/ # 资产清单、存活、指纹、功能入口 ├── 02-scan/ # 扫描结果、候选漏洞清单 ├── 03-verify/evidence/ # 验证记录、证据(截图/请求响应) ├── 04-report/ # 最终报告(一洞一份) └── submit/ # 每个漏洞一个 zip(附件,≤50M) ``` ## 平台知识(补天/SRC,详见 reference/butian-submission.md) 1. **专属 vs 公益 SRC**:报告"提交平台"栏必须与项目实际类型一致;先向用户确认类型再写报告。专属=厂商私有项目,公益=公众项目。 2. **定级口径**(常见):低危 1kb 无积分(druid 未授权、短信/邮箱轰炸、源码泄露、信息泄露、挂黑页等);中危 2-3kb(SQL 注入、越权、XSS、弱口令等;SQLi 提权至 shell 算高危);高危 4kb(命令执行、代码执行、文件上传、可 getshell)。 3. **漏洞类别**:Web/IoT/工控/操作系统及通用软件;漏洞类型:事件型/通用型。 4. **平台分类字段**(报告"漏洞类型(平台分类)"从中选):XSS、配置错误、弱口令、入侵事件、疑似被黑、文件上传、信息泄露、存在后门、逻辑漏洞、代码执行、命令执行、SQL注入、解析漏洞。 5. **详情要求**:完整利用过程+URL+截图+代码+POC,不达标可能审核不过;IoT 需二进制位置/目标配置/研究环境;用到的组件给下载链接或附件上传;视频压缩后附件或链接。 6. **附件限制**:仅 zip/rar、≤50M、仅压缩组件/固件/视频;截图在详情中直接上传。 …
Read the whole file at its exact version.
How to install
mdr add jensen-yao/agents-skills/bugbounty-workflow@sha256:0aad4789a8ddb5e8The line at the top of this page pins the label git:20260815.3e2d588, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_uv3z3esbhnm6eoir)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Aug 15, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (8560 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
jensen-yao/agents-skills · 5 stars · license MIT · pushed 2026-10-26 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_uv3z3esbhnm6eoir GET https://markdownregistry.com/api/v1/resolve?ref=jensen-yao/agents-skills/bugbounty-workflow GET https://markdownregistry.com/api/v1/blob/0aad4789a8ddb5e858fad30d681fc27b1091a3bf96b88519ef35dd70adcc1777
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.