---
name: Triage Validation
slug: triage-validation-2
category: Quality
description: Triage Validation applies a gate-based checklist to bug bounty findings. Use it to confirm scope, reproducibility, impact, and whether an issue should be submitted or killed.
github: "https://github.com/H-mmer/pentest-agents/tree/main/skills/triage-validation"
language: Python
stars: 804
forks: 156
install: "npx degit https://github.com/H-mmer/pentest-agents/tree/main/skills/triage-validation ~/.claude/skills/triage-validation"
installs_to: ~/.claude/skills/triage-validation
source_path: skills/triage-validation/SKILL.md
collection_size: 25
category_size: 1354
collection_url: "https://dirskills.com/collections/H-mmer/pentest-agents"
added: 2026-08-22T05:22:32.505Z
last_synced: 2026-08-22T05:22:32.505Z
canonical_url: "https://dirskills.com/skills/triage-validation-2"
---

# Triage Validation

Triage Validation applies a gate-based checklist to bug bounty findings. Use it to confirm scope, reproducibility, impact, and whether an issue should be submitted or killed.

**Install:**

```bash
npx degit https://github.com/H-mmer/pentest-agents/tree/main/skills/triage-validation ~/.claude/skills/triage-validation
```

## README

# Triage & Validation

## The 7-Question Gate (applied to EVERY finding)

First NO = KILL. Do not continue.

1. **Q1**: Exact HTTP request + response showing the issue RIGHT NOW?
2. **Q2**: Bug class accepted by this program?
3. **Q3**: Asset in-scope, owned by target (not third-party)?
4. **Q4**: Works without admin/privileged access?
5. **Q5**: Not documented behavior or known issue?
6. **Q6**: Impact proved with actual data (not just status code)?
7. **Q7**: Not on the never-submit list?

## Never-Submit List

Missing headers (CSP/HSTS/X-Frame-Options), missing SPF/DKIM/DMARC,
GraphQL introspection alone, banner/version without exploit,
clickjacking without PoC, self-XSS, open redirect alone,
SSRF DNS-only, CORS wildcard without credentialed exfil,
logout CSRF, rate limit on non-critical, missing cookie flags alone,
OAuth client_id alone, OIDC discovery endpoints, SPA client-side config.

## 4 Pre-Submission Gates

**Gate 0 (30 sec)**: Confirmed with real HTTP? In scope? Reproducible? Evidence?

**Gate 1 (2 min)**: What does attacker walk away with? Real victim? Max 2 preconditions?

**Gate 2 (5 min)**: Searched hacktivity? Read disclosed reports? Not in changelog?

**Gate 3 (10 min)**: Title follows formula? Steps have exact HTTP? CVSS calculated?

## Conditional Validity (chain required)

| Finding | Chain Needed | Without Chain |
|---|---|---|
| Open redirect | + OAuth code theft → ATO | KILL |
| SSRF DNS-only | + internal data exfil | KILL |
| CORS wildcard | + credentialed data theft | KILL |
| GraphQL introspection | + auth bypass on mutations | KILL |
| S3 listing | + secrets in bundles | KILL |
| Prompt injection | + IDOR via chatbot | KILL |

## Severity Calibration

| Impact | Severity |
|---|---|
| Full ATO, RCE, mass PII exfil | Critical |
| Read/modify other user's private data | High |
| Stored XSS in victim context | Medium-High |
| Info disclosure (sensitive creds) | Medium |
| Info disclosure (non-sensitive) | Low/Info |