# Sync > Sync program scope, policy, and hacktivity from a bug bounty platform. Usage: /sync hackerone tesla or /sync bugcrowd uber - Skill: `h-mmer/sync` (Agent Skill) - Install (CLI): `npx skillmds@latest add h-mmer/sync` - Raw SKILL.md: https://api.skillmd.com/api/skills/h-mmer/sync/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: h-mmer (https://skillmd.com/u/h-mmer) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/h-mmer/sync --- Sync bug bounty program data: $ARGUMENTS Parse the arguments as: 1. Use the `bounty-platforms` MCP server tool `sync_program` with the platform and program handle. This fetches scope, policy, and hacktivity and writes them to the current directory. 2. After sync completes, run `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py init` if brain isn't initialized yet. 3. Read the generated `scope.yaml` and `hacktivity.md` files. 4. Update the brain with key intelligence from hacktivity: - Run `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py log "Synced program data from /"` - If hacktivity shows common vulnerability types, note them as priority areas - If hacktivity shows many duplicates of a type, note them as areas to avoid 5. Summarize: scope overview, policy highlights (restrictions, safe harbor), and hacktivity patterns (most common vuln types, average bounties). ## Top-Tier Sync Standard Policy is hunting input, not paperwork. Extract and persist: - exact in-scope assets, wildcard rules, mobile/API/cloud qualifiers, and third-party exclusions - required headers, user-agent, testing accounts, sandbox rules, rate limits, and forbidden actions - severity exclusions and never-pay classes - payout hints from hacktivity: accepted classes, duplicate-heavy classes, bounty tiers, triage language - newly added or removed assets since last sync End with a hunt bias: where the program appears to pay, where it appears saturated, and what proof standard the policy implies.