How do I install the Tradecraft Duplicate Avoidance skill?

Run npx skillmds@latest add noorqureshi/tradecraft-duplicate-avoidance in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Tradecraft Duplicate Avoidance safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Tradecraft Duplicate Avoidance?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Tradecraft Duplicate Avoidance free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Tradecraft Duplicate Avoidance?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Tradecraft Duplicate Avoidance by noorqureshi

Name: Tradecraft Duplicate Avoidance
Author: NoorQureshi

Tradecraft Duplicate Avoidance

Avoid burning time on bugs that will be closed as duplicates. Load during bug-bounty work when deciding what to report or where to dig, on "will this be a dup", "is this already known", maximizing unique findings. Signals: a mature/popular program, a common vuln on an obvious asset, a recently expanded scope.

NoorQureshi Updated Sep 17, 2026

File contents

Duplicate avoidance

When it applies

Bug-bounty payouts go to the first valid report. On popular programs the obvious bugs on obvious assets are already found, so the skill is steering toward findings that are still unclaimed — and recognising when a bug you have is likely already in the queue.

Why it works

Duplication is a function of visibility and timing: the more hunters have seen an asset and the longer it's been in scope, the lower your odds on a surface-level bug. Freshness and novelty move you to the front of the line, where the same effort actually pays.

Method

Read the disclosed reports for the program (and the researcher's public activity) to learn what's already been found and what patterns the program pays for.
Hunt fresh surface: newly added scope, a feature shipped this week, an acquisition's domains — the crowd hasn't swept these yet. Monitor scope-change and asset feeds (automation-*).
Go deeper, not wider: a chained/business-logic bug or a variant behind auth is far less likely to be a dup than reflected XSS on the marketing site.
Vary the obvious: if you find a common bug, look for the non-obvious instance (a second endpoint, a different parameter, a bypass of the partial fix) that others stopped short of.
Move fast on fresh scope: when a program expands, the first 24-48h are the least duplicated — prioritise then.
Sanity-check before reporting: does this need no special preconditions and sit on the most obvious asset? If so, assume others found it — raise the bar or add a unique angle.

Gotchas

"Informative"/duplicate closes still cost you and the triager time — quality over quantity.
Some programs pay dupes partially or not at all; know the policy (tradecraft-bugbounty-platforms).
Novelty isn't an excuse for a weak report — a unique bug still needs solid proof (reporting-*).

Verify success

Before investing in a report you can name why it's likely not a duplicate — fresh asset, behind auth, a chain, or a variant others missed — not just "it's a valid bug".

References

Program disclosure timelines; researcher write-ups on dup rates; the tradecraft-target-selection skill.

---name: tradecraft-duplicate-avoidancedescription: Avoid burning time on bugs that will be closed as duplicates. Load during bug-bounty work when deciding what to report or where to dig, on "will this be a dup", "is this already known", maximizing unique findings. Signals: a mature/popular program, a common vuln on an obvious asset, a recently expanded scope.---# Duplicate avoidance## When it appliesBug-bounty payouts go to the *first* valid report. On popular programs the obvious bugs on obviousassets are already found, so the skill is steering toward findings that are still unclaimed — andrecognising when a bug you have is likely already in the queue.## Why it worksDuplication is a function of visibility and timing: the more hunters have seen an asset and thelonger it's been in scope, the lower your odds on a surface-level bug. Freshness and novelty move youto the front of the line, where the same effort actually pays.## Method1. **Read the disclosed reports** for the program (and the researcher's public activity) to learn what's already been found and what patterns the program pays for.2. **Hunt fresh surface**: newly added scope, a feature shipped this week, an acquisition's domains — the crowd hasn't swept these yet. Monitor scope-change and asset feeds (`automation-*`).3. **Go deeper, not wider**: a chained/business-logic bug or a variant behind auth is far less likely to be a dup than reflected XSS on the marketing site.4. **Vary the obvious**: if you find a common bug, look for the *non-obvious instance* (a second endpoint, a different parameter, a bypass of the partial fix) that others stopped short of.5. **Move fast on fresh scope**: when a program expands, the first 24-48h are the least duplicated — prioritise then.6. **Sanity-check before reporting**: does this need no special preconditions and sit on the most obvious asset? If so, assume others found it — raise the bar or add a unique angle.## Gotchas- "Informative"/duplicate closes still cost you and the triager time — quality over quantity.- Some programs pay dupes partially or not at all; know the policy (`tradecraft-bugbounty-platforms`).- Novelty isn't an excuse for a weak report — a unique bug still needs solid proof (`reporting-*`).## Verify successBefore investing in a report you can name why it's likely *not* a duplicate — fresh asset, behindauth, a chain, or a variant others missed — not just "it's a valid bug".## ReferencesProgram disclosure timelines; researcher write-ups on dup rates; the `tradecraft-target-selection` skill.

Frequently asked questions