YesWeHack Claude Kit

What it is

YesWeHack Claude Kit is a Claude Code plugin (GPL-3.0-or-later) distributed as its own plugin marketplace. It targets bug bounty report writing, adding an always-on "discipline" layer and three namespaced on-demand skills. Beyond what the summary states, the page gives the concrete install/update mechanics and one non-obvious usage constraint.

How it works

Two components ship in one install:

1. Always-on rules injected at every session start via a bundled SessionStart hook — no configuration needed. They enforce: never invent facts, never write theoretical impact, never pad with OWASP boilerplate, and flag out-of-scope or unprovable claims during investigation, drafting, and validation.
2. Three on-demand skills, namespaced under /ywh:... so they don't clash with your own. /ywh:write shapes notes into report sections and flags gaps; /ywh:triage runs a pre-submission verdict with line-by-line fixes checked against program scope; a third does class-specific checks. Skills load only when invoked or when phrasing semantically matches their trigger.

What to do

Install (two commands inside Claude Code):

/plugin marketplace add yeswehack/claude-kit
/reload-plugins

Confirm it is listed and enabled with /plugin. Default install is user scope (active in all projects); the installer also offers project and local scopes.

Update:

/plugin update ywh@yeswehack

Develop locally:

git clone https://github.com/yeswehack/claude-kit
/plugin marketplace add ./claude-kit
/reload-plugins

Caveats

Auto-invocation is semantic and not guaranteed — for the final pre-submission check you must invoke /ywh:triage explicitly rather than rely on trigger matching. The tool constrains but does not replace verification: it drafts and validates only from evidence you supply and leaves CVSS unscored where facts (e.g. whether a race condition persists past checkout) are unconfirmed.