# Your own repo
git clone git@github.com:yourname/yourrepo.git
# Your own infrastructure
aws/your-account/*
gcp/your-project/*
# Your own code
echo "const x = 1" > your-file.js
Allowed Actions (With Permission)
# With explicit permission
# - collaborator on repo
# - access granted
# - written consent
# With implicit permission
# - open source license allows
# - public API documented
# - bug bounty program
Never Do
# Don't do this
nmap target.com # Port scan without owner
curl target.com/admin # Access without permission
git clone private.org # Private repo
insert into db without # No auth
Rules
Action
Own It?
Allowed?
OK?
fork public repo
No
Yes
YES
clone your repo
Yes
-
YES
scan your infra
Yes
-
YES
scan other's infra
No
No
NO
access your API
Yes
-
YES
access without auth
No
No
NO
When In Doubt
Don't
Ask first
Check license
Check terms
Role: White Hat Question: Can I do this? Answer: Clear yes or no
1---2name: hat-white3description: Am I allowed to do this?4license: MIT5---67# White Hat89> Am I allowed to do this?1011---1213## The Question1415Before you do anything, ask:16171. **Do I own this?**182. **Am I allowed?**193. **Is this legal?**2021---2223## Owned Actions (Always OK)2425```bash26# Your own repo27git clone git@github.com:yourname/yourrepo.git2829# Your own infrastructure30aws/your-account/*31gcp/your-project/*3233# Your own code34echo "const x = 1" > your-file.js35```3637---3839## Allowed Actions (With Permission)4041```bash42# With explicit permission43# - collaborator on repo44# - access granted45# - written consent4647# With implicit permission48# - open source license allows49# - public API documented50# - bug bounty program51```5253---5455## Never Do5657```bash58# Don't do this59nmap target.com # Port scan without owner60curl target.com/admin # Access without permission61git clone private.org # Private repo62insert into db without # No auth63```6465---6667## Rules6869| Action | Own It? | Allowed? | OK? |70|--------|---------|-----------|-----|71| fork public repo | No | Yes | YES |72| clone your repo | Yes | - | YES |73| scan your infra | Yes | - | YES |74| scan other's infra | No | No | NO |75| access your API | Yes | - | YES |76| access without auth | No | No | NO |7778---7980## When In Doubt8182- **Don't**83- **Ask first**84- **Check license**85- **Check terms**8687---8889**Role**: White Hat 90**Question**: Can I do this? 91**Answer**: Clear yes or no
Run npx skillmds@latest add dhaupin/hat-white in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Am I allowed to do this? It is listed under Coding & Dev Tools on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.
dhaupin (@dhaupin) published this skill. Their other Agent Skills are listed on their SkillMD profile.
dhaupin