hunt-brute-force

Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent shadow-throttling (avoids false-negative 'no rate limit' conclusions). Medium to Critical depending on what the brute reaches (OTP→ATO = Critical).

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-brute-force/SKILL.md

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced body with strong validation discipline and executable commands throughout, but it is long and monolithic with no progressive disclosure via bundle files, costing conciseness and structure points.

Suggestions

Move the per-phase bash probes into scripts/ (e.g. phase1-classify.sh, shadow-throttle-seed.sh) and reference them from the body to cut inline length and improve progressive disclosure.

Condense the grounding-note preamble and the repeated 'necessary not sufficient' caveats into a single short discipline note; trust Claude to apply the stated checks without re-stating them.

Extract the ffuf/hydra/nuclei Automation block into references/automation.md and link to it, keeping SKILL.md as an overview.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient and avoids explaining basics Claude knows, but the ~290 lines include repeated caveats and a grounding-note preamble that could be tightened; verbosity is penalized even when accurate.	2 / 3
Actionability	Phases 1–6 and the Automation section give fully executable, copy-paste-ready curl loops plus ffuf/hydra/nuclei invocations with real flags, matching the 'fully executable code/commands' anchor.	3 / 3
Workflow Clarity	Six numbered phases are clearly sequenced and the 'Validation — false-positive discipline' section supplies explicit checkpoints (shadow-throttle seed test, reachability math, ≥20 samples, toggle-rotation-off delta, benign control), with feedback loops for the risky brute operations.	3 / 3
Progressive Disclosure	Sections are well organized, but the skill is a single ~290-line monolithic file with no bundle files; the per-phase bash and automation details could be split into scripts/references rather than kept inline.	2 / 3
	Total	10 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, highly specific description that names concrete actions and natural trigger terms and carves out a distinct niche, but it lacks an explicit 'Use when...' clause so the when-to-use guidance is only implied.

Suggestions

Add an explicit trigger clause, e.g. 'Use when assessing authentication endpoints for brute-force, OTP/reset-token guessing, credential stuffing, or user enumeration vulnerabilities.'

Consider trimming the parenthetical CAPTCHA-deferral aside to keep the description scannable; the cross-skill pointer can live in the body.

Dimension	Reasoning	Score
Specificity	Lists many concrete actions — 'login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration... IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS' — matching the 'multiple specific concrete actions' anchor.	3 / 3
Completeness	The 'what' is thoroughly answered with concrete hunt targets, but there is no 'Use when...' clause or equivalent explicit trigger guidance, which the guidelines cap at 2.	2 / 3
Trigger Term Quality	Natural terms a tester would say are well covered — 'brute force', 'rate limiting', 'credential stuffing', 'enumeration', 'OTP/2FA', 'ReDoS', 'password reset' — matching the good-coverage anchor; not jargon-only.	3 / 3
Distinctiveness Conflict Risk	Clear niche (rate-limiting/brute-force/enumeration) with a distinct trigger surface, and it explicitly defers CAPTCHA specifics to 'hunt-captcha-bypass' to avoid overlap, matching the clear-niche anchor.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-brute-force/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.