CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-exceptional-conditions

Hunt mishandling of exceptional conditions — feed an endpoint malformed/unexpected input (wrong type, broken JSON, oversized field, null byte) and make it fail OPEN or leak internals: a verbose stack-trace / framework error page that discloses ORM internals, server file paths, library versions, or a language traceback. Use on any input-accepting endpoint (JSON APIs, forms, query params). Medium-High when the leak exposes internal structure that arms a deeper attack.

72

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

100%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, highly actionable hunting playbook: concrete payloads, framework-specific disclosure signatures, a clear recon-to-validation sequence, and clean sectioning with no padding or redundant concept explanations.

DimensionReasoningScore

Conciseness

The body is lean and assumes competence — it frames the attack ('A broken app... renders a developer error page straight to the client') without explaining what an ORM, stack trace, or framework is, and every section earns its tokens; not level 2 because there is no unnecessary explanation to trim.

3 / 3

Actionability

Provides concrete, copy-paste-ready payloads ('{"rating":"notanumber","comment":[1,2,3]}', 'GET /item/%00') and specific per-framework disclosure signatures (SequelizeDatabaseError, '<b>Warning</b> ... /var/www/...', 'Traceback (most recent call last)') — fully executable guidance rather than vague direction.

3 / 3

Workflow Clarity

A clear Recon → Attack → confirm-signal → Validation-discipline sequence with an explicit verification checkpoint ('A clean JSON error... is NOT a finding — that's correct handling') and evidence-capture guidance; this is a read-only hunting flow so the destructive/batch cap does not apply, fitting the level-3 anchor.

3 / 3

Progressive Disclosure

A simple single-purpose skill (~60 lines, no external references needed) organized into well-signaled sections (Recon, Attack, What counts as a leak, Validation discipline); per the simple-skills note, well-organized sections with no need for bundle files score 3.

3 / 3

Total

12

/

12

Passed

Description

77%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped security-hunting description with concrete attack actions and explicit trigger guidance, but it leans on attacker jargon over natural user terms and its endpoint-wide trigger risks overlap with the broader hunt skill family.

Suggestions

Add natural-language trigger terms users would actually say (e.g. 'Use when testing for verbose error messages, debug page disclosure, or stack-trace leaks') to lift trigger-term quality.

Narrow the trigger to reduce conflict with sibling skills, e.g. 'Use when probing input-accepting endpoints specifically for error-message disclosure or fail-open behavior'.

Keep the concise concrete-action list as-is; it is the strongest part of the description.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'feed an endpoint malformed/unexpected input (wrong type, broken JSON, oversized field, null byte) and make it fail OPEN or leak internals: a verbose stack-trace / framework error page that discloses ORM internals, server file paths, library versions' — matching the 'lists multiple specific concrete actions' anchor; not level 2 because the action set is comprehensive rather than partial.

3 / 3

Completeness

Answers both what ('feed an endpoint malformed/unexpected input ... make it fail OPEN or leak internals') and when with an explicit trigger clause ('Use on any input-accepting endpoint (JSON APIs, forms, query params)'), satisfying the explicit-trigger requirement that would otherwise cap this at 2.

3 / 3

Trigger Term Quality

Relevant domain keywords appear ('verbose stack-trace', 'framework error page', 'fail OPEN', 'leak internals') but the phrasing is jargon-heavy and omits natural variations a user might say such as 'error disclosure', 'debug error page', or 'stack trace leak'; not level 3 because coverage of common natural terms is incomplete, not level 1 because several usable keywords are present.

2 / 3

Distinctiveness Conflict Risk

The disclosure signal is specific, but the trigger 'Use on any input-accepting endpoint' is broad and overlaps with sibling hunt-* skills (it even names hunt-sqli/hunt-lfi) that target the same endpoints; not level 3 because conflict with similar skills is plausible, not level 1 because the niche (verbose error / fail-open) is clearly framed.

2 / 3

Total

10

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.