# Report Writing

Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi, report templates, human...

- Repository: https://github.com/awarexone/Agentic-Bug-Hunter (5532 stars)
- Category: Writing
- License: MIT
- Last updated: 2026-10-28
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add awarexone/Agentic-Bug-Hunter --skill report-writing -g -a claude-code -y`
Codex: `npx skills add awarexone/Agentic-Bug-Hunter --skill report-writing -g -a codex -y`
Cursor: `npx skills add awarexone/Agentic-Bug-Hunter --skill report-writing -g -a cursor -y`
Gemini CLI: `npx skills add awarexone/Agentic-Bug-Hunter --skill report-writing -g -a gemini-cli -y`

## Description

Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi, report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use "could potentially", prove it or don't report.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# REPORT WRITING

Impact-first. Human tone. No theoretical language. Triagers are people.

---

## THE MOST IMPORTANT RULE

> **Never use "could potentially" or "could be used to" or "may allow".**
> Either it does the thing or it doesn't. If you haven't proved it, don't claim it.

```
BAD:  "This vulnerability could potentially allow an attacker to access user data."
GOOD: "An attacker can access any user's order history by changing the user_id
       parameter to the target user's ID. I confirmed this using two test accounts:
       attacker@test.com (ID 123) successfully retrieved victim@test.com (ID 456)
       orders, including their shipping address and payment method last 4 digits."
```

## PERSISTENCE RULE

Every report-writing session must leave a complete finding folder on disk. Save
the report draft, pre-submit checklist, references, downgrade counters, and final
submission note under `findings/<target-or-program>-<bug-class>/`. Never rely on
terminal or tmux scrollback for content the hunter needs later.

Minimum files:

```text
findings/<target-or-program>-<bug-class>/
├── hackerone-report.md       # or bugcrowd-report.md / intigriti-report.md / immunefi-report.md
├── submission-notes.md       # final checklist, references, caveats, next action
└── evidence/                 # screenshots, curl output, response bodies when available
```

If `bughunter/tools/validate.py` already wrote `submission-notes.md`, append/update it
instead of creating a duplicate.

---

## TITLE FORMULA

```
[Bug Class] in [Exact Endpoint/Feature] allows [attacker role] to [impact] [victim scope]
```

The rest: https://github.com/awarexone/Agentic-Bug-Hunter/blob/HEAD/skills/report-writing/SKILL.md