QualitySAFE

Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops, exploit chain builder.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: quality
description: "Score a report draft before submission. Usage: /quality <draft-path-or-finding-description>"
disable-model-invocation: false
---
Quality-check a report draft: $ARGUMENTS

1. If a file path is given, read the draft file.
2. Launch `quality-check` agent with the draft content.
3. Show the score and any issues to fix.
4. If score < 7, recommend specific improvements.
5. If score >= 7, confirm the report is ready for submission.

## Top-Tier Quality Bar

Block reports that are merely plausible.

Score against:
- reproducibility: exact steps, accounts, URLs, headers, and stable artifacts
- impact proof: real capability demonstrated without prohibited access
- severity fit: CVSS/vector matches the proven final state, not the hoped-for chain
- novelty: dupcheck considered and prior art handled
- evidence hygiene: screenshots, recordings, PoC paths, and request/response pairs exist on disk
- triage empathy: title, summary, and remediation let the program act fast

If any artifact is missing, say exactly what command or capture step fixes it. Do not let a fluent report compensate for weak proof.

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (1)

Gates applied: no_behavioural_pass, no_license.