Agent skill · security · mvanhorn
pp-yeswehack
Every YesWeHack researcher feature, plus an offline SQLite-backed cockpit for scope cartography, drift detection,... Trigger phrases: `hunt on yeswehack`, `qualify a yeswehack program`, `triage my yeswehack programs`, `draft a yeswehack report`, `is this yeswehack bug a duplicate`, `what changed in yeswehack scope`, `yeswehack hacktivity for fintech`, `use yeswehack`, `run yeswehack-pp-cli`.
Why this skill is useful
Adds a CLI tool for offline SQLite-backed management of YesWeHack programs, enabling faster triage and reporting workflows.
What it needs
Requires yeswehack-pp-cli installed locally. About 11k tokens when loaded. Last updated 2026-08-06. 1,890 stars on the source repository.
What this skill does
<!-- GENERATED FILE — DO NOT EDIT. This file is a verbatim mirror of library/developer-tools/yeswehack/SKILL.md, regenerated post-merge by tools/generate-skills/. Hand-edits here are silently overwritten on the next regen. Edit the library/ source instead. See the repository agent guide, section "Generated artifacts: registry.json, cli-skills/". --> YesWeHack — Printing Press CLI Prerequisites: Install the CLI This skill drives the yeswehack-pp-cli binary. You must verify the CLI is installed before invoking any command from this skill. If it is missing, install it first: 1. Install via the Printing Press installer: 2. Verify: yeswehack-pp-cli --version 3. Ensure $GOPATH/bin (or $HOME/go/bin) is on $PATH. If the npx install fails (no Node, offline, etc.), fall back to a direct Go install (requires Go 1.26.6 or newer): If --version reports "command not found" after install, the install step did not put the binary on $PATH. Do not proceed with skill commands until verification succeeds. yeswehack-pp-cli is the researcher-side cockpit for the YesWeHack bug bounty platform. It syncs every program you can see, every scope, every hacktivity disclosure into a local SQLite store so an agent can answer 'what should I work on', 'has this been reported', and 'what is in scope here' in milliseconds, offline. Submit and draft commands are guard-railed by design - the goal is better reports, not more reports. When to Use This CLI Reach for this CLI when a security researcher (or their agent) is qualifying YesWeHack programs, drafting a report, or trying to calibrate severity from prior disclosures. Particularly strong for agent-driven triage workflows where the agent needs structured local state to answer 'has this been reported', 'what is in scope', and 'which program pays the most for this asset'. Skip it for program-manager workflows (use ywh2bugtracker) and for one-off curl calls to the public API. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills mvanhorn/pp-yeswehack