Agent skill · security · mvanhorn
pp-yeswehack
Every YesWeHack researcher feature, plus an offline SQLite-backed cockpit for scope cartography, drift detection,... Trigger phrases: `hunt on yeswehack`, `qualify a yeswehack program`, `triage my yeswehack programs`, `draft a yeswehack report`, `is this yeswehack bug a duplicate`, `what changed in yeswehack scope`, `yeswehack hacktivity for fintech`, `use yeswehack`, `run yeswehack-pp-cli`.
Why this skill is useful
Adds executable CLI commands for offline data management and triage specific to the YesWeHack platform, which are not available in public documentation.
What it needs
Requires yeswehack-pp-cli installed locally. About 10k tokens when loaded. Last updated 2026-08-06. 1,890 stars on the source repository.
What this skill does
YesWeHack — Printing Press CLI Prerequisites: Install the CLI This skill drives the yeswehack-pp-cli binary. You must verify the CLI is installed before invoking any command from this skill. If it is missing, install it first: 1. Install via the Printing Press installer: 2. Verify: yeswehack-pp-cli --version 3. Ensure $GOPATH/bin (or $HOME/go/bin) is on $PATH. If the npx install fails (no Node, offline, etc.), fall back to a direct Go install (requires Go 1.26.6 or newer): If --version reports "command not found" after install, the install step did not put the binary on $PATH. Do not proceed with skill commands until verification succeeds. yeswehack-pp-cli is the researcher-side cockpit for the YesWeHack bug bounty platform. It syncs every program you can see, every scope, every hacktivity disclosure into a local SQLite store so an agent can answer 'what should I work on', 'has this been reported', and 'what is in scope here' in milliseconds, offline. Submit and draft commands are guard-railed by design - the goal is better reports, not more reports. When to Use This CLI Reach for this CLI when a security researcher (or their agent) is qualifying YesWeHack programs, drafting a report, or trying to calibrate severity from prior disclosures. Particularly strong for agent-driven triage workflows where the agent needs structured local state to answer 'has this been reported', 'what is in scope', and 'which program pays the most for this asset'. Skip it for program-manager workflows (use ywh2bugtracker) and for one-off curl calls to the public API. When Not to Use This CLI Do not activate this CLI for requests that require creating, updating, deleting, publishing, commenting, upvoting, inviting, ordering, sending messages, booking, purchasing, or changing remote state. This printed CLI exposes read-only commands for inspection, export, sync, and analysis. Unique Capabilities These capabilities aren't available in any other tool for this API. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills mvanhorn/yeswehack