hunt-brute-force

Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent shadow-throttling (avoids false-negative 'no rate limit' conclusions). Medium to Critical depending on what the brute reaches (OTP→ATO = Critical).

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strongly actionable, well-sequenced hunting playbook with concrete code and rigorous validation/feedback loops. The main gap is progressive disclosure: the skill is a single large file with no references or split-out detail files.

Suggestions

Extract the Automation tooling block (ffuf/hydra/nuclei) and the Phase 5 entropy-measurement recipes into a references/ file (e.g. references/automation.md, references/token-entropy.md), keeping SKILL.md as an overview that links one level deep.

Tighten the repeated '101 codes is necessary not sufficient' explanation so it appears once (Phase 2) and is referenced elsewhere, reducing token redundancy.

Consider a short '## When to use this skill' section near the top that mirrors the missing description trigger clause, aiding discoverability.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and focused on domain-specific knowledge Claude likely lacks (the four rate-limit states, shadow-throttle detector); minor repetition such as re-explaining why a 101-code probe is 'necessary not sufficient' in both Phase 1 and Phase 2 could be tightened.	4 / 5
Actionability	Fully executable, copy-paste-ready guidance throughout — concrete curl burst loops, the shadow-throttle seed script, ffuf/hydra/nuclei commands, and entropy-measurement one-liners covering the common cases.	5 / 5
Workflow Clarity	Phases 1–6 are clearly sequenced with explicit validation checkpoints and feedback loops — 'CONFIRM the bypass: re-run Phase 1 WITHOUT rotation to show the 429 returns', the shadow-throttle seed test, and the dedicated 'Validation — false-positive discipline' checklist.	5 / 5
Progressive Disclosure	Well-organized with clear section headers, but it is a ~290-line monolithic SKILL.md with everything inline and no bundle files; content that could live one level deeper (the Automation tool reference, per-phase scripts) is inlined rather than split out.	3 / 5
	Total	17 / 20 Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, distinctive description with strong trigger-term coverage of the brute-force/rate-limiting domain. Its main weakness is the absence of an explicit 'Use when ...' invocation clause, which caps completeness.

Suggestions

Add an explicit trigger clause, e.g. 'Use when testing login, OTP/2FA verification, password-reset, or code-validation endpoints for missing or bypassable rate limits, or when hunting enumeration / ReDoS.'

Move the severity tail ('Medium to Critical depending on what the brute reaches') into the body and replace it with a sharper when-to-use cue so the description front-loads invocation triggers.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across the domain — 'login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration ... IP-based rate-limit bypass via X-Forwarded-For ... ReDoS' — comprehensive coverage of the technique classes.	5 / 5
Completeness	It clearly answers 'what' (hunt missing/weak rate limiting across the listed vectors) but lacks any explicit 'Use when...' trigger clause, so per the rubric a missing explicit trigger caps completeness at 3.	3 / 5
Trigger Term Quality	Natural domain keywords a user would say are present with synonyms — 'brute force', 'rate limiting', 'OTP/2FA', 'credential stuffing', 'enumeration', 'CAPTCHA', 'ReDoS', 'X-Forwarded-For' — covering the common phrasings a security tester would invoke.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (rate-limiting/brute-force hunting) and even draws an explicit boundary — 'CAPTCHA ... specifics → hunt-captcha-bypass' — minimizing conflict with sibling skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-brute-force/SKILL.md
Commit: 58017df

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.