Agent skill

Triage

Self-validates a bug bounty report draft before submission. An agent skill from yeswehack/claude-kit.

GPL-3.0Auto-check passedSecurity

Install Triage

skills CLI

$ npx skills add yeswehack/claude-kit --skill triage -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install yeswehack/claude-kit triage --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/yeswehack/claude-kit.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/triage .claude/skills/triage && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "triage" agent skill from https://github.com/yeswehack/claude-kit/tree/main/skills/triage into .claude/skills/triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/yeswehack/claude-kit/tree/main/skills/triage

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add yeswehack/claude-kit --skill triage -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install yeswehack/claude-kit triage --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/yeswehack/claude-kit.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/triage .agents/skills/triage && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "triage" agent skill from https://github.com/yeswehack/claude-kit/tree/main/skills/triage into .agents/skills/triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add yeswehack/claude-kit --skill triage -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install yeswehack/claude-kit triage --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/yeswehack/claude-kit.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/triage .cursor/skills/triage && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "triage" agent skill from https://github.com/yeswehack/claude-kit/tree/main/skills/triage into .cursor/skills/triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/yeswehack/claude-kit.git --path skills/triage

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add yeswehack/claude-kit --skill triage -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install yeswehack/claude-kit triage --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/yeswehack/claude-kit.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/triage .gemini/skills/triage && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "triage" agent skill from https://github.com/yeswehack/claude-kit/tree/main/skills/triage into .gemini/skills/triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install yeswehack/claude-kit triage

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add yeswehack/claude-kit --skill triage -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/yeswehack/claude-kit.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/triage .github/skills/triage && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "triage" agent skill from https://github.com/yeswehack/claude-kit/tree/main/skills/triage into .github/skills/triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add yeswehack/claude-kit --skill triage -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install yeswehack/claude-kit triage --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/yeswehack/claude-kit.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/triage .opencode/skills/triage && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "triage" agent skill from https://github.com/yeswehack/claude-kit/tree/main/skills/triage into .opencode/skills/triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: triage
GitHub stars: 107
Token cost: ~1k tokens
SKILL.md length: 511 words
Files: 2 (incl. references)
Skills in repo: 3
Repo updated: Aug 25, 2026
First seen: Oct 7, 2026
Licence: GPL-3.0

At a glance

Self-validates a bug bounty report draft before submission. An agent skill from yeswehack/claude-kit.

Works in 4 steps: Scope → AI-slop → PoC quality → …
Tasks that involve Bug bounty
SKILL.md covers Required inputs, Output format, Triage flow and Hard rules
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Triage is an agent skill from yeswehack/claude-kit. Self-validates a bug bounty report draft before submission. Run on every draft. Returns a verdict (READY / NEEDS FIXES / DO NOT SUBMIT) with concrete fixes. Applies the AI-slop reference on every draft and the gotchas skill when a specific class is claimed.

Its SKILL.md is about 1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/ai-slop.md`).

It sits in Security, covering Bug bounty. The repository describes itself as: Claude Code plugin for writing triager-grade bug bounty reports. The licence is GPL-3.0.

When your agent uses it

Tasks that involve Bug bounty

Example prompts

“/triage”

Workflow steps

4 steps, taken from the step headings in SKILL.md.

Scope
AI-slop
PoC quality
Vulnerability-class gotchas

What it can do on your machine

Read from SKILL.md and the folder at commit 3928c34. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Triage loads about 1k tokens when it runs, and up to ~2.3k if it reads all its reference files. Until then it costs about 66 tokens; SKILL.md has 511 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~66
When it runs · the whole SKILL.md, loaded when a task matches: ~1k
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~2.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from yeswehack/claude-kit at commit 3928c34, republished under its GPL-3.0 licence (© yeswehack). 511 words, ~1,022 tokens.

Download SKILL.mdSave it as .claude/skills/triage/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.

name: triage
description: Self-validates a bug bounty report draft before submission. Run on every draft. Returns a verdict (READY / NEEDS FIXES / DO NOT SUBMIT) with concrete fixes. Applies the AI-slop reference on every draft and the gotchas skill when a specific class is claimed.

Bug Bounty Report Self-Triage

You are a strict senior triager. You are reviewing the hunter's draft before submission. Catch what real triagers would catch, so the hunter can fix it now.

Required inputs

The draft report (markdown or plain text).
The program's scope page and rules of engagement.

If either is missing, ask for it. Do not guess. Do not infer scope from a domain name alone.

Output format

Return only this. Omit sections that are empty (except VERDICT and What's good).

VERDICT: [READY TO SUBMIT | NEEDS FIXES | DO NOT SUBMIT]

## Critical (blocks submission)
- [issue] → [fix]

## Major (needs fixing)
- [issue] → [fix]

## Minor (cleanup)
- [issue] → [fix]

## What's good
- [things to keep]

Triage flow

Run checks in this order. Stop early only if a critical scope failure makes the rest moot (out-of-scope target).

1. Scope

Critical (DO NOT SUBMIT)

Asset (domain, IP, app ID) not in the in-scope list or matching wildcard.
Staging / preview / dev environment not explicitly listed or matching wildcard.
Acquired / sister-company domain that looks related but isn't named.
Vuln class is excluded: missing security headers, SPF/DKIM/DMARC, self-XSS, low-impact CSRF (logout, search), clickjacking on non-sensitive pages, rate-limit issues without meaningful impact, raw scanner output.
Testing violated rules: DoS / load testing, mass PII download, credential bruteforce, account spam, social engineering, physical testing, testing outside allowed windows.

Major

Severity claimed exceeds the program's cap for this class.
Gray-area asset not explicitly listed → get pre-approval or add a boundary-case note in the report.

2. AI-slop

Read the AI-slop reference bundled with this skill (references/ai-slop.md) and apply it in full. Bring back every red flag it surfaces, mapped to Critical / Major / Minor as defined in that reference.

Show full SKILL.md (266 more words)Show less

3. PoC quality

A PoC is valid only if a triager with no prior knowledge of the bug can replay it from scratch using only the report.

Critical

No working PoC. Pseudocode, vague description, or "the attacker would..." language instead of a concrete reproduction.
Steps skip the interesting part ("...", "etc.").
Claimed impact not demonstrated by the PoC (claims RCE → must show command execution; claims ATO → must take over an account; claims SSRF → must show inbound request on hunter-controlled endpoint).
Chained bug missing a PoC for one of the links.

Major

Preconditions not stated (auth state, browser, external setup).
Raw HTTP requests / exact payloads missing — only described.
Expected vs actual response not shown.
Visual bug with no screenshot or video referenced.

Minor

Cleanup notes missing for stateful PoCs (stored payloads, created accounts, uploaded files).
Smart quotes / unicode normalization breaking copy-pasteable payloads.

4. Vulnerability-class gotchas

If the report claims a specific class (XSS, SQLi, SSRF, IDOR, CSRF, RCE, SSTI, XXE, open redirect, auth bypass, information disclosure / secret leak, race condition, CORS misconfiguration, path traversal / LFI), apply the gotchas skill section for that class. Flag class-specific false positives and overclaim traps.

If the class isn't covered, apply general PoC + impact rigor.

Hard rules

Never invent facts about the target or the vulnerability. If you can't verify it from the draft + provided artifacts, say so.
Never rewrite the report for the hunter. Point to issues; don't author. If the hunter asks for a rewrite, refuse and list the issues.
Never approve a PoC you can't mentally replay step by step.
No false reassurance. Bluntness now beats a rejected report later.

Files

SKILL.md and 1 other file (references) in skills/triage of yeswehack/claude-kit.

SKILL.md
references/ai-slop.md

Open the folder on GitHubat commit 3928c34

Compare with similar skills

Triage next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Triage compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Triage this skillyeswehack/claude-kit	107	—	~1k	Automated safety check: Pass	GPL-3.0	1 mo ago
Web3 Smart Contract Auditawarexone/Agentic-Bug-Hunter	5.3k	3 repos	~4.5k	Automated safety check: Pass	MIT	3 days ago
Bug Bounty Hunting Methodologyawarexone/Agentic-Bug-Hunter	5.3k	2 repos	~4.7k	Automated safety check: Pass	MIT	3 days ago
Metabigor OSINT Reconj3ssie/metabigor	1.9k	—	~2.4k	Automated safety check: Pass	MIT	2 mo ago
Wooyun Legacytanweai/wooyun-legacy	1.8k	—	~1.9k	Automated safety check: Pass	Custom licence	2 mo ago
Client Request Signature Reversalawarexone/Agentic-Bug-Hunter	5.3k	—	~4.7k	Automated safety check: Pass	MIT	3 days ago

Similar skills

Web3 Smart Contract Audit
awarexone/Agentic-Bug-Hunter
Guides smart contract audits and bounty target selection with ten DeFi bug classes, kill signals, a Foundry PoC template and grep patterns.
5.3k GitHub starsUsed in 3 repos~4.5k tokens
SecurityAuto-check passed
Bug Bounty Hunting Methodology
awarexone/Agentic-Bug-Hunter
Orchestrates a bug bounty session with a 5-phase workflow and a critical-thinking framework covering developer psychology, anomaly detection and What-If experiments.
5.3k GitHub starsUsed in 2 repos~4.7k tokens
SecurityAuto-check passed
Metabigor OSINT Recon
j3ssie/metabigor
Operates the metabigor CLI to map a target's network ranges, subdomains, ports, related domains, CDNs and archived URLs from free sources without API keys.
1.9k GitHub stars~2.4k tokensUpdated 2 mo ago
SecurityAuto-check passed
Wooyun Legacy
tanweai/wooyun-legacy
WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws…
1.8k GitHub stars~1.9k tokensUpdated 2 mo ago
SecurityAuto-check passed
Client Request Signature Reversal
awarexone/Agentic-Bug-Hunter
Recovers a client-side request signature or anti-bot token just far enough to replay blocked requests in bug bounty testing, starting from a captured packet.
5.3k GitHub stars~4.7k tokensUpdated 3 days ago
SecurityAuto-check passed
Web3 Bug Bounty AI Tools
tradecatlabs/vibe-coding-cn
A selection guide to AI-driven tools for Web3 bug bounty work, from autonomous web pentesters to smart contract bug finders, with notes on authorization.
17k GitHub starsUsed in 2 repos~3.9k tokens
SecurityAuto-check: warnings

Questions about Triage

What does Triage do?

Self-validates a bug bounty report draft before submission. An agent skill from yeswehack/claude-kit. Triage is an agent skill from yeswehack/claude-kit. Self-validates a bug bounty report draft before submission.

When should I use Triage?

Triage fits situations like: tasks that involve Bug bounty.

How do I install Triage in Claude Code?

Run `npx skills add yeswehack/claude-kit --skill triage -a claude-code`. Or copy the skill folder (skills/triage in yeswehack/claude-kit) into .claude/skills/triage in your project. Claude Code loads it when a task matches its description.

How do I install Triage in Codex?

Run `npx skills add yeswehack/claude-kit --skill triage -a codex`. Or copy the skill folder (skills/triage in yeswehack/claude-kit) into .agents/skills/triage in your project. Codex loads it when a task matches its description.

Can I use Triage in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add yeswehack/claude-kit --skill triage -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/triage, .gemini/skills/triage, .github/skills/triage and .opencode/skills/triage in your project.

What does Triage need to run?

SKILL.md names no scripts, command-line tools or credentials: Triage is instructions for the agent only.

Does Triage access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Triage safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Triage use?

Triage is published under the GPL-3.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Triage use?

About 1k tokens (SKILL.md is roughly 4.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.3k tokens, read only when the agent opens those files.

What are the alternatives to Triage?

Skills that share tags, products or a category with Triage: Web3 Smart Contract Audit (awarexone/Agentic-Bug-Hunter, 5.3k stars), Bug Bounty Hunting Methodology (awarexone/Agentic-Bug-Hunter, 5.3k stars), Metabigor OSINT Recon (j3ssie/metabigor, 1.9k stars) and Wooyun Legacy (tanweai/wooyun-legacy, 1.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Triage?

yeswehack (a GitHub organization) maintains it in yeswehack/claude-kit, which has 107 GitHub stars. The repository holds 3 skills in this directory. The repository was last updated on August 25, 2026.

Source: yeswehack/claude-kit on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Triage

Install Triage

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Bug Bounty Report Self-Triage

Required inputs

Output format

Triage flow

1. Scope

2. AI-slop

3. PoC quality

4. Vulnerability-class gotchas

Hard rules

Files

Compare with similar skills

Similar skills

Web3 Smart Contract Audit

Bug Bounty Hunting Methodology

Metabigor OSINT Recon

Wooyun Legacy

Client Request Signature Reversal

Web3 Bug Bounty AI Tools

More from yeswehack/claude-kit

Write

Gotchas

Questions about Triage

Install Triage

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Bug Bounty Report Self-Triage

Required inputs

Output format

Triage flow

1. Scope

2. AI-slop

3. PoC quality

4. Vulnerability-class gotchas

Hard rules

Files

Compare with similar skills

Similar skills

More from yeswehack/claude-kit

Related

Questions about Triage