evidence-hygiene
实用的证据 hygiene 流程，能降低提交时暴露敏感信息或证据无效的风险。
PoC 与证据采集的脱敏与存档规范，防止泄露 cookie/PII 等敏感信息。
漏洞复现与 PoC 的证据采集和脱敏规范，告诉你截图、导出 HAR、保存日志时该遮蔽哪些 cookie/PII、哪些信息可保留，以及如何用 jq、Burp、Chrome DevTools 做清理。适合在提交漏洞报告或分享 PoC 前做最后的证据审查与脱敏。特色是提供具体步骤和命名约定，能有效避免敏感数据泄露并提高可读性。
▸ 展开 SKILL.md 英文原文
Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails, phones, faces — vs what is safe to leave — usernames, trace IDs, request bodies), HAR file sanitization (jq filters for Cookie/Set-Cookie/Authorization headers), Burp Repeater/Intruder screenshot hygiene (hide request body, show only Results table for rate-limit attacks), Chrome DevTools Console PoC patterns (credentials include so cookies are not echoed, labeled console.log), screenshot capture order, filename conventions, post-submission rotation hygiene. Use BEFORE any PoC screenshot, BEFORE attaching a HAR, or whenever preparing evidence with session cookies or other-user PII. Pairs with bugcrowd-reporting and report-writing.
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/evidence-hygiene/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/evidence-hygiene/SKILL.md"# EVIDENCE HYGIENE — PoC Capture & Redaction Discipline > Use this skill BEFORE capturing any screenshot, exporting any HAR, or attaching any evidence to a bug-bounty submission. It catches the most common evidence-hygiene mistakes that cause cookies to leak, PII to be shared without consent, or screenshots to be unsuitable for triage. The core principle: **Bug-bounty evidence is meant to convince a triager. Anything beyond that — live cookies, real-user PII, internal trace IDs that aren't useful — should not be in the evidence.** --- ## 1. Two Categories of Sensitive Data Every PoC artifact (screenshot, HAR, raw HTTP request, terminal transcript) potentially contains data that needs di