[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M78GS780NF2WN2MCHXV2F15Q":3,"skill-same:01M78GS780NF2WN2MCHXV2F15Q":47},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":21,"frontMatter":22,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":13,"repositoryHtmlUrl":30,"repositoryHomepageUrl":6,"ownerHtmlUrl":31,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":32,"install":33,"resources":46},"01M78GS780NF2WN2MCHXV2F15Q","seven-question-gate",null,"7-question gate run before promoting a finding to FINDING + opening a report. Kills weak\u002Fnon-impactful findings before they reach the report stage and damage validity ratio.","dnzengou\u002Fevo-decepticon","dnzengou","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F7807581?v=4","01M75KKJA3F5ZP7CA10MB2AEXC","01M78GP0FED2V1CDPB1N6G0CTH",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fplugins\u002Fverifier\u002Fseven-question-gate\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: seven-question-gate\ndescription: 7-question gate run before promoting a finding to FINDING + opening a report. Kills weak\u002Fnon-impactful findings before they reach the report stage and damage validity ratio.\nmetadata:\n  when_to_use: \"bug bounty triage gate validate finding before report n\u002Fa duplicate\"\n  mitre_attack: T1497\n  subdomain: verification\n---\n\n# 7-Question Gate\n\nRun this gate **after `validate_finding` returns success but BEFORE\nadding the finding to the report**. Any \"no\" → kill the finding,\ndon't write a report. This saves bounty validity-ratio and engagement-\nreport quality.\n\n## The 7 questions\n\n### 1. Is the asset in scope?\n\nCheck the engagement's `scope.md` (recon\u002Fdecepticon's RoE doc):\n- In-scope domain list\n- In-scope IP\u002FCIDR list\n- Out-of-scope explicit exclusions (test envs, staging, third-party\n  CDNs\u002FCDN-managed subdomains where the org doesn't own the\n  underlying machine)\n\nIf asset is not on the in-scope list OR on the out-of-scope list:\n**kill**. Do not write the report.\n\n### 2. Is there real-world impact?\n\nTheoretical bugs without demonstrable impact get N\u002FA on every BB\nprogram. Concrete impact statements include:\n- \"An attacker can read victim user X's PII (email, name, DOB, SSN)\"\n- \"An attacker can post on behalf of victim user X\"\n- \"An attacker can transfer funds from victim user X's account\"\n- \"An attacker can persist code on the production server\"\n- \"An attacker can pivot to internal network 10.0.0.0\u002F8\"\n\nIf the finding's impact is \"configuration is non-default\" or \"the\nmanual recommends X but the deployment does Y\" without concrete\nattacker-reachable harm: **kill**.\n\n### 3. Does the PoC actually prove the impact?\n\nThe `validate_finding` result is necessary but not sufficient. The\n**PoC must demonstrate the IMPACT**, not just trigger the vector.\n\nExamples:\n- IDOR PoC must show ATTACKER session reading VICTIM data — not\n  just \"request returned 200 OK\"\n- XSS PoC must execute attacker-controlled JS in victim's browser\n  context — not just \"alert(1) reflected in HTML source\"\n- SQLi PoC must extract real data — not just \"single quote → 500\"\n- SSRF PoC must reach an internal-only target — not just \"external\n  fetch worked\"\n\nIf the PoC stops short of impact demonstration: **kill** or queue\nfor re-verification with a better PoC.\n\n### 4. Is the impact **above the program's severity floor**?\n\nMany BB programs explicitly out-of-scope:\n- CSRF on logout endpoint\n- Self-XSS (requires victim to inject own payload)\n- Missing security headers\n- Information disclosure of public-by-design info\n- Rate-limit issues w\u002Fo demonstrated abuse\n- Subdomain takeover candidates where ownership can't be proven\n- Clickjacking without authenticated state change\n\nRead the program's \"out of scope\" \u002F \"won't fix\" \u002F \"informational\nonly\" list. If the finding falls in those: **kill** or escalate\nto a chain that crosses the floor.\n\n### 5. Can the operator reproduce it from your PoC alone?\n\nA triager will not have your engagement context. The PoC must work\nstandalone:\n- All required prerequisites stated explicitly (account\n  registration, specific user role, specific test data)\n- Exact URL \u002F parameter \u002F cookie values\n- Browser version if it matters\n- Date\u002Ftime stamp if the bug is recent and the program may patch\n  in between\n\nIf the PoC requires \"you also need state X that I had set up\": **kill**\nor rewrite the PoC to include the setup.\n\n### 6. Is it a known duplicate?\n\nCheck before submitting:\n- Run `gh search` \u002F Hacktivity search for the same vuln class on the\n  same domain\n- Read CHANGELOG \u002F recent disclosures\n- Check `confirmed-findings.md` and `rejected-hypotheses.md` notepad\n  files in the current engagement\n\nIf the report likely duplicates a known disclosure: **kill** unless\nyour variant has materially different impact or affects a different\ncomponent.\n\n### 7. Does the title sell the impact in one line?\n\nBad titles:\n- \"SSRF on \u002Fwebhook\"\n- \"JWT issue\"\n- \"Mass assignment\"\n\nGood titles:\n- \"SSRF on \u002Fwebhook → AWS instance-metadata cred extract → full\n  account takeover\"\n- \"JWT alg=none bypass → admin impersonation of any user\"\n- \"Mass assignment on PATCH \u002Fapi\u002Fusers\u002Fme → self-promote to\n  is_admin=true\"\n\nIf you can't write a one-line title that names {vuln class, target,\nimpact, severity}: **kill** and re-think whether the impact is real.\n\n## Decision\n\nIf all 7 are \"yes\" → proceed to report. Confidence: high.\n\nIf any are \"no\" → kill the finding. Mark it in\n`notepad\u002Frejected-hypotheses.md` with the question number that\nfailed and a one-line reason. Do NOT submit.\n\n## Why this gate matters\n\nBug-bounty programs track **validity ratio** (valid reports ÷ total\nsubmissions). Low validity → lower triage priority + lower long-term\nreward tier. The 7-Question Gate is the difference between a\nresearcher with 90% validity (high earner) and one with 30% validity\n(eventually banned).\n\nFor internal engagements, this gate is the difference between a\nreport consumed by stakeholders and a report that sits in a Jira\nbacklog forever.\n\n## Integration\n\nVerifier agent loads this skill BEFORE calling `update_objective`\non a validated finding. Specifically:\n\n```\n1. validate_finding(...) returns success\n2. load_skill(\"\u002Fskills\u002Fverifier\u002Fseven-question-gate\u002FSKILL.md\")\n3. Walk through Q1-Q7 — write each answer to the finding's KG node:\n     kg_add_node(kind=\"vulnerability\", key=\u003Cfinding>,\n                 props={\"gate_q1_scope\": \"yes\",\n                        \"gate_q2_impact\": \"yes\",\n                        \"gate_q3_poc_proves_impact\": \"yes\",\n                        ...})\n4. If all Q1-Q7 = yes → update_objective(status=\"passed\")\n5. If any = no → update_objective(status=\"blocked\",\n                  reason=\"seven_question_gate: \u003CQ#> failed: \u003Creason>\")\n```\n\nThis makes the gate auditable — every finding has a written record of\nwhich question pass\u002Ffailed before it reaches the report stage.\n\n## Anti-patterns\n\n| Anti-pattern | What goes wrong |\n|---|---|\n| Skip the gate \"because validate_finding passed\" | False positives reach the report; validity ratio drops |\n| Answer \"yes\" to Q4 without reading the program's out-of-scope list | Submission gets N\u002FA'd as known-out-of-scope |\n| Skip Q7 \"title sells impact\" | Triagers downgrade based on bad first-impression |\n| Run the gate AFTER report draft is written | Wasted effort writing reports that get killed |\n| Apply this only to High\u002FCritical | All findings benefit; Low findings w\u002F bad titles also damage validity |\n\n## Cross-references\n- Verifier agent prompt: `decepticon\u002Fagents\u002Fprompts\u002Fverifier.md`\n- Verifier router: `skills\u002Fverifier\u002FSKILL.md`\n- Bounty report skill: `skills\u002Fverifier\u002Fbounty-report\u002FSKILL.md`\n- Operator's external `triage-validation` skill (Decepticon-external) for the broader gate methodology\n","# 7-Question Gate\n\nRun this gate **after `validate_finding` returns success but BEFORE\nadding the finding to the report**. Any \"no\" → kill the finding,\ndon't write a report. This saves bounty validity-ratio and engagement-\nreport quality.\n\n## The 7 questions\n\n### 1. Is the asset in scope?\n\nCheck the engagement's `scope.md` (recon\u002Fdecepticon's RoE doc):\n- In-scope domain list\n- In-scope IP\u002FCIDR list\n- Out-of-scope explicit exclusions (test envs, staging, third-party\n  CDNs\u002FCDN-managed subdomains where the org doesn't own the\n  underlying machine)\n\nIf asset is not on the in-scope list OR on the out-of-scope list:\n**kill**. Do not write the report.\n\n### 2. Is there real-world impact?\n\nTheoretical bugs without demonstrable impact get N\u002FA on every BB\nprogram. Concrete impact statements include:\n- \"An attacker can read victim user X's PII (email, name, DOB, SSN)\"\n- \"An attacker can post on behalf of victim user X\"\n- \"An attacker can transfer funds from victim user X's account\"\n- \"An attacker can persist code on the production server\"\n- \"An attacker can pivot to internal network 10.0.0.0\u002F8\"\n\nIf the finding's impact is \"configuration is non-default\" or \"the\nmanual recommends X but the deployment does Y\" without concrete\nattacker-reachable harm: **kill**.\n\n### 3. Does the PoC actually prove the impact?\n\nThe `validate_finding` result is necessary but not sufficient. The\n**PoC must demonstrate the IMPACT**, not just trigger the vector.\n\nExamples:\n- IDOR PoC must show ATTACKER session reading VICTIM data — not\n  just \"request returned 200 OK\"\n- XSS PoC must execute attacker-controlled JS in victim's browser\n  context — not just \"alert(1) reflected in HTML source\"\n- SQLi PoC must extract real data — not just \"single quote → 500\"\n- SSRF PoC must reach an internal-only target — not just \"external\n  fetch worked\"\n\nIf the PoC stops short of impact demonstration: **kill** or queue\nfor re-verification with a better PoC.\n\n### 4. Is the impact **above the program's severity floor**?\n\nMany BB programs explicitly out-of-scope:\n- CSRF on logout endpoint\n- Self-XSS (requires victim to inject own payload)\n- Missing security headers\n- Information disclosure of public-by-design info\n- Rate-limit issues w\u002Fo demonstrated abuse\n- Subdomain takeover candidates where ownership can't be proven\n- Clickjacking without authenticated state change\n\nRead the program's \"out of scope\" \u002F \"won't fix\" \u002F \"informational\nonly\" list. If the finding falls in those: **kill** or escalate\nto a chain that crosses the floor.\n\n### 5. Can the operator reproduce it from your PoC alone?\n\nA triager will not have your engagement context. The PoC must work\nstandalone:\n- All required prerequisites stated explicitly (account\n  registration, specific user role, specific test data)\n- Exact URL \u002F parameter \u002F cookie values\n- Browser version if it matters\n- Date\u002Ftime stamp if the bug is recent and the program may patch\n  in between\n\nIf the PoC requires \"you also need state X that I had set up\": **kill**\nor rewrite the PoC to include the setup.\n\n### 6. Is it a known duplicate?\n\nCheck before submitting:\n- Run `gh search` \u002F Hacktivity search for the same vuln class on the\n  same domain\n- Read CHANGELOG \u002F recent disclosures\n- Check `confirmed-findings.md` and `rejected-hypotheses.md` notepad\n  files in the current engagement\n\nIf the report likely duplicates a known disclosure: **kill** unless\nyour variant has materially different impact or affects a different\ncomponent.\n\n### 7. Does the title sell the impact in one line?\n\nBad titles:\n- \"SSRF on \u002Fwebhook\"\n- \"JWT issue\"\n- \"Mass assignment\"\n\nGood titles:\n- \"SSRF on \u002Fwebhook → AWS instance-metadata cred extract → full\n  account takeover\"\n- \"JWT alg=none bypass → admin impersonation of any user\"\n- \"Mass assignment on PATCH \u002Fapi\u002Fusers\u002Fme → self-promote to\n  is_admin=true\"\n\nIf you can't write a one-line title that names {vuln class, target,\nimpact, severity}: **kill** and re-think whether the impact is real.\n\n## Decision\n\nIf all 7 are \"yes\" → proceed to report. Confidence: high.\n\nIf any are \"no\" → kill the finding. Mark it in\n`notepad\u002Frejected-hypotheses.md` with the question number that\nfailed and a one-line reason. Do NOT submit.\n\n## Why this gate matters\n\nBug-bounty programs track **validity ratio** (valid reports ÷ total\nsubmissions). Low validity → lower triage priority + lower long-term\nreward tier. The 7-Question Gate is the difference between a\nresearcher with 90% validity (high earner) and one with 30% validity\n(eventually banned).\n\nFor internal engagements, this gate is the difference between a\nreport consumed by stakeholders and a report that sits in a Jira\nbacklog forever.\n\n## Integration\n\nVerifier agent loads this skill BEFORE calling `update_objective`\non a validated finding. Specifically:\n\n```\n1. validate_finding(...) returns success\n2. load_skill(\"\u002Fskills\u002Fverifier\u002Fseven-question-gate\u002FSKILL.md\")\n3. Walk through Q1-Q7 — write each answer to the finding's KG node:\n     kg_add_node(kind=\"vulnerability\", key=\u003Cfinding>,\n                 props={\"gate_q1_scope\": \"yes\",\n                        \"gate_q2_impact\": \"yes\",\n                        \"gate_q3_poc_proves_impact\": \"yes\",\n                        ...})\n4. If all Q1-Q7 = yes → update_objective(status=\"passed\")\n5. If any = no → update_objective(status=\"blocked\",\n                  reason=\"seven_question_gate: \u003CQ#> failed: \u003Creason>\")\n```\n\nThis makes the gate auditable — every finding has a written record of\nwhich question pass\u002Ffailed before it reaches the report stage.\n\n## Anti-patterns\n\n| Anti-pattern | What goes wrong |\n|---|---|\n| Skip the gate \"because validate_finding passed\" | False positives reach the report; validity ratio drops |\n| Answer \"yes\" to Q4 without reading the program's out-of-scope list | Submission gets N\u002FA'd as known-out-of-scope |\n| Skip Q7 \"title sells impact\" | Triagers downgrade based on bad first-impression |\n| Run the gate AFTER report draft is written | Wasted effort writing reports that get killed |\n| Apply this only to High\u002FCritical | All findings benefit; Low findings w\u002F bad titles also damage validity |\n\n## Cross-references\n- Verifier agent prompt: `decepticon\u002Fagents\u002Fprompts\u002Fverifier.md`\n- Verifier router: `skills\u002Fverifier\u002FSKILL.md`\n- Bounty report skill: `skills\u002Fverifier\u002Fbounty-report\u002FSKILL.md`\n- Operator's external `triage-validation` skill (Decepticon-external) for the broader gate methodology\n",{"name":5,"metadata":23,"description":7},{"subdomain":24,"when_to_use":25,"mitre_attack":26},"verification","bug bounty triage gate validate finding before report n\u002Fa duplicate","T1497","main","376de63e2b186eeb9856476ae89186e62b1d3fbe","packages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fplugins\u002Fverifier\u002Fseven-question-gate","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon","https:\u002F\u002Fgithub.com\u002Fdnzengou","2026-11-09 16:34:40",{"source":8,"skillName":5,"commands":34,"prompt":44,"zipAvailable":45},[35,38,41],{"tool":36,"command":37},"npx","npx skills add dnzengou\u002Fevo-decepticon --skill seven-question-gate",{"tool":39,"command":40},"bunx","bunx skills add dnzengou\u002Fevo-decepticon --skill seven-question-gate",{"tool":42,"command":43},"pnpm","pnpm dlx skills add dnzengou\u002Fevo-decepticon --skill seven-question-gate","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fplugins\u002Fverifier\u002Fseven-question-gate\u002FSKILL.md",true,[],[48,55,62,69,76,83],{"skillNo":49,"name":50,"nameZh":6,"description":51,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":52,"categories":53,"keywords":54,"publishedAt":18},"01M78JAX15GZR5Q5S7RMPWFX43","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":56,"name":57,"nameZh":6,"description":58,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":59,"categories":60,"keywords":61,"publishedAt":18},"01M78JARXE0ZER8P81SFD024YP","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":68,"publishedAt":18},"01M78JANJNH8VMR0CK1Y6AM74G","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":75,"publishedAt":18},"01M78JAFCYR2BAJF7KH0ZCXREA","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":18},"01M78JAAQ5T08FR9MY5SFNRWBM","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":18},"01M78JA6799JQZE0M9B21HRMGY","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002Fdnzengou\u002Fevo-decepticon\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]