# hackenproof-report-handoff

Generate structured report handoff summaries for client teams. Use after triaging a report to produce a standardized handoff with report URL, recommended severity, bounty range, and explanation. Trigger on "handoff", "transfer to client", "prepare handoff", "client summary".

- **Kind:** skill
- **Source:** https://github.com/hackenproof-public/skills
- **Page:** https://forefy.com/skills/7fa63d46-acde-4e38-baed-98a05f4e6794
- **API (JSON + files):** https://forefy.com/api/asr/7fa63d46-acde-4e38-baed-98a05f4e6794

---

## SKILL.md

---
name: hackenproof-report-handoff
description: Generate structured report handoff summaries for client teams. Use after triaging a report to produce a standardized handoff with report URL, recommended severity, bounty range, and explanation. Trigger on "handoff", "transfer to client", "prepare handoff", "client summary".
---

# HackenProof Report Handoff

Generate a structured handoff summary after triaging a report. The handoff is what gets communicated to the client team — it must be clear, actionable, and include bounty context.

## When to Use

- After a report has been triaged (state is `Triaged` or any final state)
- When preparing a batch of triaged reports for client review
- When a client team requests a summary of findings

## Workflow

1. Run `get_program_info` to retrieve reward ranges, scopes, and program type.
2. Run `get_report_details` with `full=true` to get the complete report.
3. Extract the reward range for the report's severity from program rewards.
4. Generate the handoff summary using the template from `references/handoff-template.md`.
5. If multiple reports are provided, generate one handoff per report.

## Mandatory Tool Sequence

1. Call `get_program_info` — extract `rewards` object to map severity to bounty range.
2. Call `get_report_details` — extract title, severity, state, vulnerability description, target, and CVSS score.
3. If severity has not been set yet, recommend one using `references/severity-to-bounty.md` and program rewards.
4. Build the report URL from company, program, and report_id.
5. Produce the handoff in the exact format from `references/handoff-template.md`.

## Output Rules

- Always include the full dashboard URL.
- Always include both recommended severity AND bounty range (even if it's "$0" for informational).
- Keep the summary to 2-3 sentences max — focus on what the vulnerability is, what it impacts, and what the client should do.
- If the report is a duplicate, mention the duplication group but do NOT reference the original report ID (reporter cannot see it).
- If bounty range is not available in program info, state "Bounty range not configured for this severity" instead of guessing.

## Batch Mode

When given multiple report IDs:

1. Fetch program info once (shared across all reports).
2. Use `get_reports_details_batch` for efficiency.
3. Output handoffs sorted by severity (Critical first, then High, Medium, Low).
4. Add a summary line at the top: "X reports: Y Critical, Z High, ..."

## Quality Bar

- Every handoff must be grounded in actual report data — never fabricate impact or severity.
- Bounty range must come from `get_program_info` rewards, not from memory or assumptions.
- If the report lacks enough detail for a clear summary, note what's missing.
- Keep tone professional and neutral — this goes to the client.

## references

```

```

## references/handoff-template.md

# Handoff Template

Use this exact format for every report handoff. Do not skip any field.

## Single Report

```md
## Report Handoff

**Report**: {report_url}
**Title**: {report_title}
**Severity**: {severity}
**Recommended Bounty**: ${min} - ${max}
**Target**: {target}

### Summary

{2-3 sentence explanation: what the vulnerability is, what component is affected, and what the impact is}

### Recommendation

{What the client team should do: fix, investigate, deprioritize, or monitor. Be specific about the affected component.}
```

## Batch Header

When producing handoffs for multiple reports, add this header before the individual handoffs:

```md
# Handoff Summary for {program_name}

**Total reports**: {count}
**Breakdown**: {X Critical, Y High, Z Medium, W Low}
**Total estimated bounty range**: ${min_total} - ${max_total}

---
```

## Field Rules

- `report_url`: `https://dashboard.hackenproof.com/manager/companies/{company}/{program}/reports/{report_id}`
- `severity`: Use the severity already set on the report. If not set, recommend one and prefix with "Recommended: ".
- `bounty range`: From `get_program_info` rewards for the given severity. If rewards are not configured, write "Not configured".
- `target`: From report details. If null, write "Not specified".
- `summary`: Derived from vulnerability_description. Focus on root cause and business impact. No speculation.
- `recommendation`: Actionable next step for the client engineering team.

## references/severity-to-bounty.md

# Severity to Bounty Mapping

## How to determine bounty range

1. Call `get_program_info` for the program.
2. Look at the `rewards` field in the response.
3. Match the report severity to the corresponding reward tier.

The rewards object structure varies by program but typically contains min/max ranges per severity level.

## Bounty Notes

- Bounty ranges are program-specific — always pull from `get_program_info`, never assume.
- Some programs have fixed amounts per severity, others have ranges.
- Dual Defence programs only pay for Critical with PoC.
- Audit contest programs may have different payout structures (pool-based).
- If `rewards` is empty or missing for a severity, report "Bounty not configured for {severity}" in the handoff.