YesWeHack Claude Kit plugin
A Claude Code plugin that helps write bug bounty reports from verified facts only, with nothing invented
- 354 ★ on the repository
- Last commit
- GPL-3.0
Minimal access
Why this level
- The plugin reads your report drafts and adds rules to the context through a session-start hook
- Vulnerability report contents can be sensitive, so keep them in private repositories
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/yeswehack-claude-kitDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The plugin reads your report drafts and adds rules to the context through a session-start hook
- Vulnerability report contents can be sensitive, so keep them in private repositories
This is third-party code. Review the repository files before installing.
What it does
YesWeHack Claude Kit is a plugin from the YesWeHack platform for vulnerability hunters. It helps produce a report a triager can validate quickly. The main danger, in the authors' words, is that AI fills in technical details nobody verified. The plugin restrains that: a draft is built only from the facts you give, meaning real URLs, payloads, server responses and observed behavior. If data is missing the assistant asks instead of guessing. The plugin has two layers. The first is always-on rules: a hook adds them to the context at the start of every session. They forbid inventing facts, writing theoretical impact and padding text with boilerplate OWASP references, and they require flagging claims that are out of scope or unprovable. The second layer is three on-demand skills. /ywh:write shapes the draft into the sections YesWeHack expects. /ywh:triage returns a verdict of READY, NEEDS FIXES or DO NOT SUBMIT with concrete fixes and re-scores CVSS. /ywh:gotchas, given a vulnerability class, loads the minimum proof, common auto-close patterns and impact-overclaim traps.
Who it is for. For bug bounty hunters and pentesters who want to send triagers reports without inflated impact or unverified details.
Good fit when
- You have raw notes on a found vulnerability and need to lay them out in report sections
- Before submitting you want to know whether the draft is ready and get concrete fixes
- A draft claims CVSS 9.1 for a single cross-account read and needs an honest re-score
- The finding belongs to a specific class such as IDOR or SSRF and you need the minimum proof
- You want a folder of drafts checked with one verdict per draft, worst first
Not a fit when
- You need a tool for finding vulnerabilities: the plugin only helps with report text
- The facts are not collected yet: without real URLs, payloads and responses it will ask for them and will not make anything up
- You need the vulnerability itself verified: the skills rely on your data and reproduce nothing
- The report targets a platform with its own mandatory form, far from the YesWeHack sections
Example request
Run /ywh:triage on my IDOR draft in the reports folder: is it ready to submit and is the CVSS score honest?Limitations
Automatic invocation of skills by phrasing does not always fire, so calling /ywh:write, /ywh:triage and /ywh:gotchas directly is more reliable. The license is GPL-3.0. Reproducing the vulnerability and staying within program scope remain your responsibility. The plugin does not know the rules of a specific program, so check scope and permitted methods in its description. Vulnerability reports often hold sensitive data, so do not push them to shared repositories.
How to disable. Disable or remove the plugin in the /plugin menu of Claude Code. After that the session-start rules and the /ywh:* skills stop loading.
FAQ
How do I install YesWeHack Claude Kit in Claude Code?
Run /plugin marketplace add yeswehack/claude-kit, then /reload-plugins. The plugin is its own marketplace. By default it installs at user scope, meaning it works in all projects, and the installer also offers project and local scopes.
What do the write, triage and gotchas skills do?
write builds a draft in YesWeHack sections and asks for missing facts. triage returns a READY, NEEDS FIXES or DO NOT SUBMIT verdict with fixes. gotchas, given a vulnerability class, shows the minimum proof and common reasons a report gets closed.
How do the always-on rules differ from the skills?
The rules are added to the context by a SessionStart hook in every session and apply during investigation, drafting and validation. The skills load only on your command or a matching phrase.
Which vulnerability classes does gotchas cover?
XSS, SQLi, SSRF, IDOR, CSRF, RCE, SSTI, XXE, open redirect, auth bypass, information disclosure, race condition, CORS and path traversal (LFI).
What happens when facts for a report are missing?
The plugin does not fill in the gaps. For example, with race-condition notes where the double discount shows only in the cart response, the impact section is blocked until persistence at checkout is confirmed, and CVSS stays unscored.
Discussion
No questions or reviews yet.
Related
PluginsA skill and command bundle for authorized bug bounty and external red-team work in Claude Code: methodology, chain templates and reports
A marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
Claude Hooks (Prompt Injection Defender)
Claude Hooks
A Claude Code hook that scans file, web page and command output for hidden instructions and warns the agent
A Claude Code plugin for business-logic vulnerabilities: testing methodology and references to real WooYun cases for authorized audit reports
hackingtool plugin
hackingtool - Claude Code plugin
A Claude Code plugin wrapping 183 pentest and OSINT tools from Z4nzu/hackingtool, running them locally via Bash, WSL or Docker
README in short
Three screenshots show the plugin at work: verdicts across a folder of drafts, a triage of an IDOR report with a CVSS re-score and a draft built from race-condition notes. Installation takes two commands.