argus

Argus — the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes — CORS misconfiguration (origin reflection / null / credentialed read), CRLF & host-header injection, NoSQL injection (operator auth-bypass / $where blind), JWT attacks (alg:none / RS256→HS256 confusion / secret crack), out-of-band confirmation of blind SSRF/XXE/SQLi/RCE/Log4Shell via interactsh, and an LLM red-team corpus (prompt-injection / jailbreak / system-prompt leak / exfil / indirect injection). Use when a target exposes a JSON API, a login endpoint, JWT auth, a parameter that might reach the server, a chatbot/agent, or any endpoint suspected of a blind/out-of-band bug.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, highly actionable scanner-suite overview with executable commands for every tool and a useful routing table. Its main gap is the absence of explicit validation/verification checkpoints for batch scanning workflows, which caps workflow clarity.

Suggestions

Add an explicit 'Verify before reporting' checkpoint to the batch scan workflows (e.g. confirm a CORS reflection actually carries credentials, or re-run the OOB correlate to rule out stray callbacks) to lift workflow_clarity above the batch-operation cap of 3.

Trim the mythological framing in the opening blockquote ('Named for Argus Panoptes, the hundred-eyed giant', 'the eye that sees the invisible') to recover tokens without losing routing value.

Consider moving per-tool flag inventories and payload corpora into reference files under ./references/ and linking them one level deep, so SKILL.md stays a lean overview.

Dimension	Reasoning	Score
Conciseness	Mostly lean — it does not explain what CORS/JWT/CRLF are and jumps to executable commands — but the mythological intro ('Named for Argus Panoptes, the hundred-eyed giant', 'the eye that sees the invisible') and minor repetition between the routing table and section headers add tokens that could be trimmed.	4 / 5
Actionability	Each of the six tools ships copy-paste-ready bash commands with real flags and arguments (e.g. `tools/cors_scanner.py https://api.target.com/me --cookie "session=..."`, `tools/jwt_scanner.py "$TOKEN" --confuse --public-key jwks_pub.pem`), covering the common cases per tool.	5 / 5
Workflow Clarity	A clear routing table sequences tool selection and the OOB section has an explicit 3-step numbered flow (listener → payloads → correlate), but the scan tools are batch operations (e.g. `-l recon/.../urls/api.txt`) with no explicit validate/findings-confirmation checkpoint or false-positive feedback loop, which caps workflow clarity at 3 per the batch-operation rule.	3 / 5
Progressive Disclosure	Well-organized into a routing table plus six numbered sections with clearly signaled one-level-deep cross-references to sibling skills ([takeover](../../commands/takeover.md), [web2-vuln-classes §11](../web2-vuln-classes/SKILL.md), [bug-bounty](../bug-bounty/SKILL.md)); no bundle files exist, so all scanner detail is inline, which is appropriate for an overview but leaves minor room to split deeper reference material.	4 / 5
	Total	16 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-triggered description that names concrete capabilities and gives explicit 'Use when' guidance with multiple concrete trigger conditions. It assumes a security-specialist audience and uses the natural vocabulary of that audience.

Dimension	Reasoning	Score
Specificity	Lists six concrete scanners each with enumerated bug classes (e.g. 'CORS misconfiguration (origin reflection / null / credentialed read)', 'JWT attacks (alg:none / RS256→HS256 confusion / secret crack)'), giving comprehensive concrete-action coverage rather than vague claims.	5 / 5
Completeness	Explicitly answers both 'what' (six scanners for named bug classes) and 'when' ('Use when a target exposes a JSON API, a login endpoint, JWT auth, a parameter that might reach the server, a chatbot/agent, or any endpoint suspected of a blind/out-of-band bug') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Covers the natural trigger terms a security user would say — CORS, CRLF, NoSQL injection, JWT, blind SSRF/XXE/SQLi/RCE, Log4Shell, prompt-injection, jailbreak — with multiple synonyms/variants per class, plus concrete trigger conditions in the 'Use when' clause.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear offensive-security niche (specific web/LLM bug-class scanning) with distinct, specialized triggers that are unlikely to fire for unrelated skills.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 4 suspicious	Warning

	Total	15 / 16 Passed

Repository: Awarexone/Agentic-Bug-Hunter
Path: skills/argus/SKILL.md
Commit: e198d9a

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.