# Hackerone

HackerOne bounty program scope-guard workflow, reads program scope, enforces scope and...

- Repository: https://github.com/Netw0rkNoob/VulnClaw (3849 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Netw0rkNoob/VulnClaw --skill hackerone -g -a claude-code -y`
Codex: `npx skills add Netw0rkNoob/VulnClaw --skill hackerone -g -a codex -y`
Cursor: `npx skills add Netw0rkNoob/VulnClaw --skill hackerone -g -a cursor -y`
Gemini CLI: `npx skills add Netw0rkNoob/VulnClaw --skill hackerone -g -a gemini-cli -y`

## Description

HackerOne bounty program scope-guard workflow, reads program scope, enforces scope and program rules, then hands each in-scope asset to pentest-flow

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# HackerOne Bounty Scope-Guard Skill

You are executing a HackerOne bug bounty workflow. This Skill is a
**scope-guard wrapper**: first parse and enforce the program scope and program
rules, then hand each **in-scope asset** to `pentest-flow` for the actual
security testing. **Never touch an out-of-scope asset at any stage.**

The launch argument is a HackerOne program link (`<SCOPE LINK>`), for example
`hackerone.com/<handle>` or `.../policy_scopes`. This Skill has no preset scan
target (`requires_target: false` in frontmatter); targets are discovered from
the program scope.

## Startup and output contract

The rest: https://github.com/Netw0rkNoob/VulnClaw/blob/HEAD/vulnclaw/skills/specialized/hackerone/SKILL.md