hunt-deserialization

Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a lean, highly actionable hunting playbook with copy-paste commands across the major deserialization vectors and explicit validation/escalation guidance. Its main weakness is the Ruby Marshal phase, which stays at the hint level while the other phases are fully executable.

Suggestions

Make the Ruby Marshal phase executable like the others: include a concrete phpggc-equivalent command or a working Marshal payload snippet instead of 'Use ruby-advisory-db gadgets'.

Either provide shiro_exploit.py as a bundled script or replace the reference with a self-contained ysoserial/curl Shiro payload so Phase 1 is fully copy-paste ready.

Inline a validation checkpoint into each exploitation phase (e.g., 'confirm COLLAB callback before escalating') rather than consolidating validation only in the trailing section.

Dimension	Reasoning	Score
Conciseness	The body is dense with executable commands and code and minimal prose; it assumes Claude's competence and avoids explaining what deserialization is, with each prose line (e.g., the phar:// note) earning its place as non-obvious operational detail.	5 / 5
Actionability	Most phases (Java/ysoserial, PHP/phpggc, Python pickle, .NET, Log4Shell) provide copy-paste-ready commands, but the Ruby Marshal phase ('Use ruby-advisory-db gadgets') and the referenced-but-unprovided shiro_exploit.py are hints rather than fully executable guidance.	4 / 5
Workflow Clarity	A clear phased sequence (Phase 1–6) plus a Chain Table for escalation and a Validation section with OOB-callback confirmation steps; validation is present but detached at the end rather than inline per-phase checkpoints, leaving minor validation gaps.	4 / 5
Progressive Disclosure	Well-organized with clear section headers (Crown Jewel Targets, Attack Surface Signals, Methodology, Chain Table, Automation, Validation) and no broken or nested references; the skill is self-contained, though at ~170 lines some per-framework detail could optionally live in reference files.	4 / 5
	Total	17 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise, specific, and complete, naming concrete exploit chains and providing an explicit 'Use when' trigger clause tied to detectable target technologies. It uses third-person/imperative voice with no padding or over-claims.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete hunting targets — Java ysoserial gadget chains, PHP object injection via phpggc, Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, and JNDI/Log4Shell — giving comprehensive coverage of the deserialization hunting domain rather than vague language.	5 / 5
Completeness	Explicitly answers both 'what' (hunt insecure deserialization across named chains) and 'when' ('Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Uses natural terms a security tester would say ('Java', 'PHP serialization', 'Python pickle', '.NET', 'Ruby on Rails', 'Log4Shell', 'RCE') including synonyms like JNDI/Log4Shell, giving comprehensive keyword coverage.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche — insecure deserialization hunting with named gadget chains and framework-specific triggers — making it highly distinct with minimal conflict risk against other skills.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-deserialization/SKILL.md
Commit: 58017df

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.