yeswehack / claude-kit

YesWeHack Claude Kit 
A Claude Code plugin that helps bug bounty hunters write clear,
well-evidenced reports - the kind a triager can validate quickly.
Used well, AI speeds up report writing. The risk is that it can fill in
technical details no one actually verified. This toolkit keeps the
assistant honest: it drafts, structures, and validates reports **only
from the facts you provide** - the real URLs, payloads, responses, and
observed behavior - and asks instead of guessing when something is
missing.
One install adds two things to Claude Code: an **always-on discipline
layer** applied to every session, and **three on-demand skills** for
writing, triaging, and class-specific checks.
> **Full walkthrough:** Triager-grade reports with Claude
> Code
> on YesWeHack.
---
## Install
The plugin is its own marketplace, so installation is two commands
inside Claude Code:
 [code] 
Run `/plugin` to confirm it is listed and enabled - both layers are now
active.
By default the plugin installs at **user scope** (active in all your
projects). The installer also offers project and local scopes if you
prefer to keep it to a single workspace.
---
## In action
Ask whether a folder of drafts is ready to submit - it reads the scope
and hands back one verdict per draft, worst-first:
Pick the near-ready one and it runs the full triage. It keeps the real
IDOR but kills the "mass data breach affecting the entire user base"
overclaim - the invoice ID is a random UUIDv4, not enumerable, so `AC:H`
and the proof only shows a single cross-account read - and deflates the
draft's inflated `9.1` to a defensible **~5.9 Medium**:
It drafts too, without inventing what you didn't prove. Handed raw lab
notes on a coupon race condition, it maps them onto the report sections
and **blocks the Impact section**: the double discount was only seen in
the cart response, never confirmed persisted at checkout, so there is no
financial impact to claim yet.
Then it turns the notes into per-section pointers - two honest Impact
versions to write depending on what checkout reveals, `PR:L` justified,
CVSS left unscored until persistence is confirmed - and refuses to claim
a maximum you never tested (*"don't write attacker could get unlimited
discounts"*):
---
## How it works
Two layers, one install:
**1. Always-on rules** - injected into context at the start of every
session via a bundled `SessionStart` hook. They keep unverified claims
out of the report from the start: never invent facts, never write
theoretical impact, never pad with OWASP boilerplate, and flag
out-of-scope or unprovable claims - during investigation, drafting, and
validation alike. Nothing to copy or configure; they apply from your
first prompt.
**2. Three on-demand skills** - loaded only when you invoke them (or when
your phrasing matches their trigger):
| Skill | Invoke it for... | What it does |
|---|---|---|
| `/ywh:write` | "how should I structure this?", "help me write this up" | Shapes the draft into the required sections