CtrlK
BlogDocsLog inGet started
Tessl Logo

client-reverse

Client-side request-signing and anti-bot token reversal for bug bounty — when a request carries a sign/sig/hmac/token/nonce/timestamp/X-Sensor header that Burp Repeater cannot replay, recover the signer just enough to reproduce the request outside the client. Packet-first staging (capture real request → prove replay works → only reverse if replay fails) across the locate→recover→runtime→validation→replay spine. Covers tracing backward from the signature field (writer→builder→entry→source), isolating user-mutable sign inputs (timestamp/nonce/deviceId/body) vs constants (secret key), hooking fetch/XHR in DevTools, JS deobfuscation basics (webpack/wasm/JSVMP), and the bounty payoff: reach the protected API to then hunt IDOR/auth/business-logic. Use when Burp/mitmproxy replay of a signed or anti-bot-gated request fails and you suspect a client-computed field is blocking you.

76

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, highly actionable multi-stage guide with executable code, explicit validation checkpoints, and a clean staged workflow. Its main weaknesses are mild verbosity in framing prose and some content duplication between the body and the browser-JS reference.

Suggestions

Collapse the duplicated material (staged spine, input-classification table, DevTools locate moves) into the reference and keep SKILL.md to the overview + a pointer, trimming the body length.

Tighten motivational framing lines ('the signature is the lock on the door', 'Most hunters waste hours...') into terse guidance so every token earns its place.

Consider moving the real-paid-examples block into the reference or a separate examples file so the SKILL.md overview stays a fast entry point.

DimensionReasoningScore

Conciseness

The body assumes Claude's competence — it does not re-explain HMAC, Burp, or webpack — and is densely actionable, but a few framing passages ('the signature is the lock on the door', 'Most hunters waste hours') and the overlap with the reference could be trimmed. It sits above the midpoint, just short of fully lean.

4 / 5

Actionability

Provides copy-paste-ready executable guidance across the common cases: DevTools XHR/fetch breakpoint steps, a console hook snippet that logs sign(input)->output, a Python HMAC signer with canonicalization notes, a Python IDOR-sweep fuzzer, and a bash bundle-secret grep — each concrete and runnable with clearly marked placeholders.

5 / 5

Workflow Clarity

A clearly sequenced stage spine (locate→recover→runtime→validation→replay) with enter/goal/exit criteria per stage, a packet-first decision gate, an explicit validation stage with an `assert sign(...) == observed_sig` checkpoint, a Stage 5 readiness checklist, and a fix-retry loop ('diff the pre-hash message string, not the output hash'). Validation is present for the batch fuzzing path, so the batch cap does not apply.

5 / 5

Progressive Disclosure

SKILL.md is a well-sectioned overview pointing to one clearly signaled, one-level-deep reference (references/browser-js-signing.md, verified to exist) plus cross-referenced sibling skills. Minor organization gap: the spine, input-classification table, and DevTools locate moves are duplicated between the body and the reference rather than living in one place.

4 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, trigger-rich description that names concrete capabilities, supplies synonyms and tool names a hunter would actually say, and explicitly pairs a 'what' with a 'Use when' clause. It is long but packed with specifics rather than padded.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'recover the signer just enough to reproduce the request', 'tracing backward from the signature field (writer→builder→entry→source)', 'isolating user-mutable sign inputs', 'hooking fetch/XHR in DevTools', 'JS deobfuscation basics (webpack/wasm/JSVMP)', 'reach the protected API to then hunt IDOR/auth/business-logic' — giving comprehensive coverage rather than vague abstraction.

5 / 5

Completeness

Explicitly answers both what (recover the signer to reproduce the request outside the client, across a named staging spine, covering tracing/isolation/hooking/deobfuscation/reaching the protected API) and when ('Use when Burp/mitmproxy replay of a signed or anti-bot-gated request fails and you suspect a client-computed field is blocking you').

5 / 5

Trigger Term Quality

Covers the natural terms a bug bounty hunter would say, including synonyms ('sign/sig/hmac/token/nonce/timestamp/X-Sensor header'), tool names ('Burp Repeater', 'Burp/mitmproxy'), and the symptom ('cannot replay', 'anti-bot-gated request'), with concrete trigger phrasing.

5 / 5

Distinctiveness Conflict Risk

Occupies a clear niche — client-side request-signing/anti-bot reversal for bug bounty — with a highly specific trigger (Burp replay of a signed or anti-bot-gated request fails), giving minimal overlap risk with other skills.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
Awarexone/Agentic-Bug-Hunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.