bug-bounty
Bug bounty program management and security disclosure expertise for smart contracts. Covers program setup on Immunefi, vulnerability triage, responsible disclosure coordination, bounty payments, and post-disclosure analysis.
npx skills add a5c-ai/babysitter --skill bug-bounty --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Bug Bounty/Security Disclosure Skill Expert management of bug bounty programs and responsible security disclosure for blockchain protocols. ## Capabilities - **Program Setup**: Configure bug bounty programs on Immunefi and other platforms - **Scope Definition**: Define assets, severity tiers, and exclusions - **Vulnerability Triage**: Assess and validate security reports - **Responsible Disclosure**: Coordinate disclosure timelines and communications - **Bounty Management**: Calculate and process bounty payments - **Post-Disclosure**: Conduct post-mortem analysis and lessons learned ## MCP/Tool Integration | Tool | Purpose | Reference | |------|---------|-----------| | **Trail of Bits Skills** | Security analysis, property testing | [building-secure-contracts](https://github.com/trailofbits/skills) | | **Slither MCP** | Static analysis for validation | [slither-mcp](https://github.com/trailofbits/slither-mcp) | | **Phalcon MCP** | Transaction analysis | [phalcon-mcp](https://github.com/mark3labs/phalcon-mcp) | ## Bug Bounty Program Setup ### Immunefi Program Structure ```yaml program: name: "Protocol Name" website: "https://protocol.xyz" assets: smart_contracts: - type: "Smart Co
- Capabilities
- MCP/Tool Integration
- Bug Bounty Program Setup
- Immunefi Program Structure
- Severity Classification
- Vulnerability Triage Workflow
- 1. Initial Assessment
- 2. Validation Process
- 3. Severity Adjustment
- Responsible Disclosure Process
- Timeline
- Communication Templates
- Bounty Calculation
- Factors
Clone and setup test environment git clone <protocol-repo> cd protocol Create PoC test forge test --match-test test_VulnerabilityPoC -vvvv Run against mainnet fork forge test --fork-url $MAINNET_RPC --match-test test_VulnerabilityPoC
What does the bug-bounty skill do?
Bug bounty program management and security disclosure expertise for smart contracts. Covers program setup on Immunefi, vulnerability triage, responsible disclosure coordination, bounty payments, and post-disclosure analysis.
How do I install it?
Run `npx skills add a5c-ai/babysitter --skill bug-bounty --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From a5c-ai/babysitter, a repository with 1,642 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.