---
name: Duplicate Check
slug: duplicate-check
category: Quality
description: Duplicate Check searches platform hacktivity and local findings to see whether a vulnerability has already been reported. Use it before writing up a finding to judge duplicate risk and related prior art.
github: "https://github.com/H-mmer/pentest-agents/tree/main/.claude/skills/dupcheck"
language: Python
stars: 804
forks: 156
install: "npx degit https://github.com/H-mmer/pentest-agents/tree/main/.claude/skills/dupcheck ~/.claude/skills/dupcheck"
installs_to: ~/.claude/skills/dupcheck
source_path: .claude/skills/dupcheck/SKILL.md
collection_size: 25
category_size: 1354
collection_url: "https://dirskills.com/collections/H-mmer/pentest-agents"
added: 2026-08-22T05:22:34.289Z
last_synced: 2026-08-22T05:22:34.289Z
canonical_url: "https://dirskills.com/skills/duplicate-check"
---

# Duplicate Check

Duplicate Check searches platform hacktivity and local findings to see whether a vulnerability has already been reported. Use it before writing up a finding to judge duplicate risk and related prior art.

**Install:**

```bash
npx degit https://github.com/H-mmer/pentest-agents/tree/main/.claude/skills/dupcheck ~/.claude/skills/dupcheck
```

## README

Check for duplicate reports: $ARGUMENTS

1. Determine the platform and program from `scope.yaml` in the current directory.
2. Use `bounty-platforms` MCP tool `search_hacktivity` with platform, program, and "$ARGUMENTS" as the query.
3. Also search local findings: `uv run python3 $CLAUDE_PROJECT_DIR/tools/dedup_findings.py --stats --db findings.json`
4. Read `hacktivity.md` if it exists and grep for related terms.
5. Report:
   - Exact or near matches from hacktivity (potential duplicates)
   - Related reports that might overlap
   - If the area appears heavily reported (high duplicate risk)
   - Verdict: likely unique, possible duplicate, or high duplicate risk

## Writeup Cross-Reference (if writeup-search MCP is available)

After checking local findings, also search the writeup database:
- Use `search_writeups` MCP tool with "<finding description> <target>"
- If similar writeups exist, assess whether your finding is novel or a known pattern
- Mention relevant prior art in the "Known Techniques" section of the report

## Top-Tier Duplicate Analysis

Duplicate risk is about overlap of exploit primitive and affected asset, not keyword similarity.

Report four verdict fields:
- `same_asset_same_primitive`: likely duplicate unless your impact is strictly stronger
- `same_primitive_different_asset`: possible duplicate; explain scope difference and novelty
- `same_asset_different_primitive`: usually unique; prove a different root cause
- `known_class_new_chain`: often worth reporting if the chain reaches a new impact tier

Check disclosed writeups for patch language and response tone. If triagers historically close this class as N/A, require chain proof before submission. If public reports stop at a weaker impact, frame your report around the new capability, not the shared first step.