enterprise-vpn-attack

External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape. Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway — these are the most common initial-access points in 2024-2026 actor TTPs.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete curl-based fingerprints and exploit tests across all major VPN vendors, but it is a monolithic document that could be split into reference files and lacks explicit validation feedback loops for its destructive operations.

Suggestions

Split the per-vendor CVE matrices and the default-credentials table into one-level-deep reference files (e.g. cve-matrix.md, defaults.md) so SKILL.md stays an overview, lifting progressive_disclosure.

Add explicit validate->decide->escalate feedback loops (e.g. 'if /remote/fgt_lang returns plaintext usernames → vulnerable, then X; if 404 → skip CVE-2018-13379') for the destructive/batch steps to raise workflow_clarity.

Trim time-sensitive and explanatory asides ('GP uses PHP', 'Most enterprise VPNs now use SAML for SSO', '2024-2026 actor TTPs') since Claude already knows this, improving conciseness.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and operational, but includes some padding Claude doesn't need ('GP uses PHP', 'Most enterprise VPNs now use SAML for SSO') and time-sensitive framing ('2024-2026 actor TTPs') that could be tightened, fitting the score-2 anchor rather than score-3.	2 / 3
Actionability	Abundant copy-paste-ready curl commands with exact paths, --path-as-is, specific headers, cookie/grep indicators, and a built 24812-byte Host-header payload, matching the score-3 anchor for fully executable code and specific examples.	3 / 3
Workflow Clarity	A clear ordered probe sequence and guardrails exist, but the destructive/batch operations (pre-auth RCE, cred spraying, nuclei sweeps) lack an explicit validate->fix->retry feedback loop, capping at score-2 per the destructive-operation guidance.	2 / 3
Progressive Disclosure	No bundle files exist and the ~350-line body keeps all per-vendor CVE matrices and default-credential tables inline rather than splitting them into one-level-deep reference files, matching the score-2 anchor where content that should be separate is inline.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and complete — it names concrete actions, a precise vendor niche, and an explicit 'Use whenever...' clause. It is a strong description with only minor provenance padding that does not detract from clarity.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'version fingerprinting', 'CVE matrix', 'AAA backend identification', 'default credentials', 'configuration-disclosure paths', 'pre-auth RCE/SSRF/path-traversal exploits' — matching the score-3 anchor for multiple specific concrete actions.	3 / 3
Completeness	Explicitly answers both what ('Covers version fingerprinting, CVE matrix...') and when ('Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway'), matching the score-3 example that combines actions with a Use-when clause.	3 / 3
Trigger Term Quality	Natural terms a user would say are well covered — 'SSL VPN', 'remote-access gateway', 'VPN appliance', plus the full vendor list (Cisco, Fortinet, Citrix, Palo Alto, Pulse, Ivanti, SonicWall, F5) — matching the good-coverage score-3 anchor.	3 / 3
Distinctiveness Conflict Risk	Narrowly scoped to external SSL VPN perimeter appliances with a specific vendor list and explicit exclusions, giving it a clear niche unlikely to trigger the wrong skill, matching the score-3 anchor.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/enterprise-vpn-attack/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.