# Hackerone

HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents...

- Repository: https://github.com/transilienceai/communitytools (600 stars)
- Category: Security
- License: MIT
- Last updated: 2026-07-29
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add transilienceai/communitytools --skill hackerone -g -a claude-code -y`
Codex: `npx skills add transilienceai/communitytools --skill hackerone -g -a codex -y`
Cursor: `npx skills add transilienceai/communitytools --skill hackerone -g -a cursor -y`
Gemini CLI: `npx skills add transilienceai/communitytools --skill hackerone -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add transilienceai/communitytools`

## Description

HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# HackerOne Bug Bounty

Automates: scope parsing → parallel testing per asset → **authoritative finding validation** → submission reports.

## Quick start

1. Input: HackerOne program URL or scope CSV.
2. Parse scope and program guidelines.
3. Spawn one coordinator per eligible asset (parallel).
4. Each coordinator runs the standard engagement flow (see `skills/coordination/SKILL.md`).
5. Run the **`validate-findings` workflow per asset** (authoritative submission gate). Generate HackerOne reports from the validated set ONLY, never submit a finding that is not `VALID`/`REPAIRED`.

## Scope CSV format

Expected columns:
- `identifier`, asset URL/domain.
- `asset_type`, URL, WILDCARD, API, CIDR.
- `eligible_for_submission`, must be `true`.
- `max_severity`, critical / high / medium / low.
- `instruction`, asset-specific notes.

Parse with `skills/hackerone/tools/csv_parser.py`. Filter for `eligible_for_submission=true`.

## Agent deployment

One coordinator per asset, spawned in parallel:

```python
coordinator_role = Read("skills/coordination/SKILL.md")
Agent(prompt=f"{coordinator_role}\n\nTARGET: {asset_url}\nSCOPE: {program_guidelines}\nOUTPUT_DIR: ...",
      run_in_background=True)
```

10 assets → 10 parallel coordinators (~2-4 h vs 20-40 h sequential). Each coordinator follows `skills/coordination/SKILL.md` and `reference/role-matrix.md`.

## Finding validation (authoritative submission gate)

Every finding requires `poc.py` (executable exploit), `poc_output.txt` (timestamped execution proof), manual repro steps, and evidence (screenshots / HTTP captures / video). This is the input the validator consumes.

**After each asset's coordinator returns, the orchestrator runs the `validate-findings` workflow for that asset and submits ONLY findings it marks `VALID` or `REPAIRED`:**

The rest: https://github.com/transilienceai/communitytools/blob/HEAD/skills/hackerone/SKILL.md