hunt-api-misconfig

Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this skill covers only non-crypto JWT handling. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, XSS in browser). HTTP verb: GET-bypass-CSRF, X-HTTP-Method-Override, TRACE enabled. Detection: API responses with extra fields, JWTs in headers (decode at jwt.io). CORS misconfiguration (reflect-any-origin, null origin, subdomain-regex bypass, postMessage) is owned by hunt-cors. Use when hunting API misconfigs, mass-assignment, prototype pollution (JWT crypto → hunt-jwt-crypto).

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with well-sequenced, validated hunt workflows, but it is a long monolithic single file with no progressive disclosure and is loaded with time-sensitive citations/dates that hurt token efficiency. It also re-includes JWT-crypto and CORS sections the description assigns to sibling skills, creating a mild description/body conflict.

Suggestions

Move the OData WAF-bypass and NSwag/Swagger-exposure sections into separate reference files (e.g. references/odata-bypass.md, references/swagger-exposure.md) and keep SKILL.md as a concise overview linking to them one level deep.

Collect the CVE citations, writeup URLs, and date/version markers into a single 'Disclosed cases / references' or 'old patterns' section so the main hunt guidance stays lean.

Resolve the description/body conflict: either remove the JWT-None, RS256→HS256, and CORS-Exploitation sections (which the description says are owned by hunt-jwt-crypto / hunt-cors) or update the description to reflect that non-crypto JWT and CORS exploitation are in scope here.

Dimension	Reasoning	Score
Conciseness	Mostly actionable and not padded with basics Claude knows, but it carries heavy time-sensitive material — CVEs, writeup URLs, 'Dec 2023', 'May 2024', '2024-2026 surface' — none placed in an 'old patterns'/'deprecated' section, which the rubric says should penalize conciseness.	2 / 3
Actionability	Copy-paste-ready throughout: concrete __proto__ payloads, curl probes ('curl -s -I -H "Origin: https://evil.com" ...'), jq recipes ('jq ".paths \| keys" swagger.json'), enumerated discovery paths, and specific parameter-pollution URL patterns.	3 / 3
Workflow Clarity	Multi-step hunt sequences are explicitly numbered with validation checkpoints and feedback loops: 'Do not stop at a 200 response to __proto__; prove that polluted prototype state reaches a later operation', 'Exploit only to prove impact', and the Swagger detection checklist is a clear 5-step sequence.	3 / 3
Progressive Disclosure	No bundle files exist (references/, scripts/, assets/ are absent) and the body is a ~267-line monolithic wall of text; large self-contained topics (OData WAF bypass, NSwag/Swagger exposure) sit inline and could be split into one-level-deep reference files, so organization is only adequate.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: concrete capabilities, explicit Use-when triggers, and clear disambiguation from sibling hunt-* skills. It is somewhat dense/padded but every part earns its place, and voice is correctly third-person.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions: 'send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints', '__proto__ injection in JSON merge / Object.assign / lodash _.merge', 'GET-bypass-CSRF, X-HTTP-Method-Override, TRACE enabled' — not vague.	3 / 3
Completeness	Answers both what (the misconfig classes and concrete payloads) and when explicitly: 'Use when hunting API misconfigs, mass-assignment, prototype pollution (JWT crypto → hunt-jwt-crypto).'	3 / 3
Trigger Term Quality	Natural terms a user would say are well covered: 'API security misconfiguration', 'mass assignment', 'prototype pollution', 'API misconfigs'; also pairs with detection cues like 'API responses with extra fields'.	3 / 3
Distinctiveness Conflict Risk	Clear niche with explicit conflict avoidance: 'JWT signature/crypto forging ... is owned by hunt-jwt-crypto' and 'CORS misconfiguration ... is owned by hunt-cors', so it is unlikely to trigger for the wrong skill.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-api-misconfig/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.