CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-deserialization

Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails.

72

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

80%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, highly actionable deserialization hunting playbook with executable code for every major language. Its weakness is workflow structure: validation sits as a terminal checklist rather than embedded feedback loops, and the monolithic single-file layout leaves no room for progressive disclosure.

Suggestions

Add per-phase validation checkpoints with explicit retry guidance (e.g., 'If no DNS callback, try alternate gadget chain and re-test') instead of a single terminal Validation section.

Consider splitting the six per-language phases into a references/ directory (e.g., java.md, php.md) with a one-level-deep pointer from SKILL.md to improve progressive disclosure.

Add an explicit 'confirm exploit' feedback loop after each RCE PoC step (verify /etc/passwd + id output before declaring Critical).

DimensionReasoningScore

Conciseness

Lean, code-dense playbook that assumes Claude's competence — it never explains what deserialization is and every section earns its tokens with actionable signals or commands.

3 / 3

Actionability

Fully executable, copy-paste-ready commands and code: ysoserial generation, phpggc chains, a complete pickle `__reduce__` exploit, and curl-based JNDI payloads with concrete headers.

3 / 3

Workflow Clarity

Phases 1–6 are clearly sequenced by language and a terminal Validation section gives confirmation criteria, but validation is a final checklist rather than embedded per-phase 'validate → fix → retry' feedback loops for these destructive RCE operations.

2 / 3

Progressive Disclosure

Well-organized into named sections with header navigation, but it is a single self-contained ~160-line document with no bundle files or one-level-deep references to split out the per-language playbooks.

2 / 3

Total

10

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names concrete per-language deserialization actions and provides an explicit 'Use when' trigger clause in third-person imperative voice. It answers both what and when with low conflict risk.

DimensionReasoningScore

Specificity

Lists multiple concrete actions across languages — 'Java gadget chains (ysoserial)', 'PHP object injection (phpggc)', 'Python pickle RCE', '.NET BinaryFormatter', 'Ruby Marshal.load', 'JNDI/Log4Shell' — matching the multiple-specific-actions anchor.

3 / 3

Completeness

Explicitly answers both what ('Hunt Insecure Deserialization ...') and when ('Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails'), satisfying the explicit-trigger requirement.

3 / 3

Trigger Term Quality

Domain-natural terms a pentester would actually say — 'Insecure Deserialization', 'ysoserial', 'phpggc', 'pickle', 'Log4Shell', 'Ruby on Rails' — give good coverage of likely trigger phrasing.

3 / 3

Distinctiveness Conflict Risk

A clearly defined niche (deserialization RCE hunting) with distinct, technology-specific triggers unlikely to fire for unrelated skills.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.