Stats
Actions
Tags
From apple-vuln-research-security-report-submission
Submit vulnerability reports to Apple Security Research (security.apple.com). Use when: (1) preparing a macOS/iOS vulnerability report for Apple's bounty program, (2) need to know which affected area dropdown to select, (3) structuring PoC code and panic logs for Apple's submission form, (4) estimating bounty category and payout, (5) understanding Target Flags for maximum rewards. Covers: submission process, form fields, affected area mapping, bounty categories, report structure, attachment packaging, and Target Flag eligibility.
How this skill is triggered — by the user, by Claude, or both
Slash command
/apple-vuln-research-security-report-submission:apple-vuln-research-security-report-submissionThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Apple's security vulnerability reporting process has specific requirements for form fields,
Apple's security vulnerability reporting process has specific requirements for form fields, affected area categories, and attachment formats that aren't well-documented publicly.
https://security.apple.com/submit (requires Apple ID login)
Alternative: email [email protected] (no tracking)
| Field | What to put |
|---|---|
| Title | Short, specific: "Unprivileged kernel panic via [component] [mechanism]" |
| Affected Area | See dropdown mapping below |
| Description | Full report: summary, affected versions, reproduction steps, PoC inline, root cause, impact, CVSS, remediation |
| Attachments | Zip with: report.md, PoC source, panic logs, crash reports. Max 500MB. |
| Credit | Your name (or click "anonymous researcher" link to hide identity) |
| Bug Type | Select |
|---|---|
| Kernel panic from IOKit UserClient | Daemons and Frameworks |
| Bluetooth driver crash | Bluetooth |
| WiFi driver issue | WiFi (scroll down past Bluetooth) |
| Siri/Apple Intelligence | Siri |
| Sandbox escape | Sandbox |
| TCC bypass | TCC |
| Gatekeeper bypass | Gatekeeper |
| Safari/WebKit | Safari or WebKit |
| iCloud | iCloud |
| Code signing (AMFI/TXM) | Daemons and Frameworks (no dedicated category) |
| Kernel memory corruption | Daemons and Frameworks (no Kernel category in dropdown) |
[Title]
SUMMARY: [1-2 sentences]
AFFECTED: [product] [version] ([build]). [scope statement]
REPRODUCTION:
Save as [filename]:
[inline PoC code]
Compile: [command]
Run: [command]
[Expected result]
ROOT CAUSE: [technical explanation]
IMPACT: [what an attacker can do]
See attached zip for full report, panic logs, and PoC.
| Category | Payout |
|---|---|
| Network → Kernel (no interaction) | $2,000,000 |
| Network → Kernel (with interaction) | $1,000,000 |
| Wireless proximity → App processor | $1,000,000 |
| App → Kernel (sandbox escape) | $500,000 |
| Physical → Sensitive data | $500,000 |
| Browser → Kernel | $1,000,000 |
| iCloud unauthorized access | $1,000,000 |
| macOS Gatekeeper bypass | $100,000 |
| Logic flaw / privilege escalation | $50,000 |
| Local unprivileged DoS (kernel panic) | $50,000-$100,000 (estimate) |
| TCC bypass | $5,000-$10,000 |
Bonuses: +50% beta, +100% Lockdown Mode bypass, +150% both
Target Flags are built-in CTF markers in Apple OS. Required for maximum bounty in applicable categories (marked with ⚑).
tccutil flag checkmkdir -p /tmp/report-name
cp report.md /tmp/report-name/
cp poc.c /tmp/report-name/
cp *.panic /tmp/report-name/ # kernel panic logs
cp *.ips /tmp/report-name/ # crash reports
cd /tmp && zip -r ~/Desktop/report-name.zip report-name/
Creates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.
npx claudepluginhub dmaynor/dmaynor-skills-marketplace --plugin apple-vuln-research-security-report-submission