Claude Skill MartBrowse skillsQuick linesLearn by videoTerminal guideWhat is a Skill?
 
← Back to list

Responsible Disclosure to CVE

Takes a proven vulnerability through private vendor reporting, timeline coordination, CVE assignment, and public advisory publication.

Security & ReviewAdvanced★ 322⑂ 44AI score 7/10Last updated: Sep 1, 2026

What it does

  • Packages a reproducible finding into a send-ready report: title, affected/fixed versions, CWE class, CVSS vector and score, repro steps, minimal PoC, impact, suggested fix, contact.
  • Locates the right contact in priority order: /.well-known/security.txt → SECURITY.md → security@vendor → PSIRT → bug bounty program → GitHub private vulnerability reporting → CERT/CC.
  • Proposes and tracks a ~90-day coordinated timeline, with CERT/CC escalation if the vendor goes dark.
  • Picks the correct CVE path: vendor CNA, GitHub Security Advisory (GitHub issues the ID), or MITRE's request form as CNA of last resort.
  • Drafts the public advisory at raw/research/<project>/advisory.md and moves the finding status from candidate → reported → CVE-<id> → published.

Who it's for

  • Security researchers turning findings into credited CVEs
  • Bug bounty hunters, PSIRT and AppSec teams standardizing disclosure workflows
  • Users of the TORCH repo's research skill tracking findings in findings.md

Example uses

  1. "Report this to the vendor" → produces a professional, non-extortive report draft plus the discovered contact channel
  2. "Request a CVE" → opens a GitHub Security Advisory draft for OSS, or fills the MITRE request fields otherwise
  3. After the patch ships → publishes an advisory with CVE ID, CVSS, timeline, and credit

Note: the skill gates on a proven, novelty-checked finding and on legal authorization / safe harbor. Do not use it against live third-party systems without permission.

· · · Install guide · · ·

Try it now, no install

Paste this into Claude to use the skill without installing anything.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/Encod3d-Sec/TORCH/HEAD/skills/disclosure/SKILL.md

What I want: (describe your task here)

If Claude can't open the link, open it yourself and paste the contents instead.

↓ If it works for you, download the ZIP below and install it. Then it runs on its own — no pasting each time.

Install in the Claude app (no terminal)
  1. Download the ZIP with the button below.
  2. In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
  3. Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.
↓ Download ZIP
Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the skills/disclosure folder from the GitHub repo Encod3d-Sec/TORCH into my ~/.claude/skills/disclosure/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/Encod3d-Sec/TORCH.git /tmp/TORCH && mkdir -p ~/.claude/skills && cp -r /tmp/TORCH/skills/disclosure ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

  1. Open a terminal.
  2. Clone the repo: git clone https://github.com/Encod3d-Sec/TORCH.git
  3. Create the skills directory: mkdir -p ~/.claude/skills
  4. Copy the skill: cp -r TORCH/skills/disclosure ~/.claude/skills/
  5. Because it references the research skill and the responsible-disclosure wiki page, copy everything: cp -r TORCH/skills/* ~/.claude/skills/ and keep the repo's wiki/ folder in your project.
  6. Restart Claude Code and say "disclose this finding" or "request a CVE" to trigger it.
View source on GitHub ↗License: MIT