CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-forgot-password

Hunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via different responses for valid vs invalid email, (2) reset token exposed directly in the API response body, (3) reset token not invalidated after use (replay), (4) password reset link works from a different IP/browser (no binding), (5) no rate limit on the reset request endpoint. These are the standalone recovery-flow broken-auth primitives — distinct from reset-email host-header poisoning (hunt-host-header) and the full ATO chain (hunt-ato owns password-reset as an ATO path; prove the primitive here, chain it there). Detection: trace the full forgot-password flow from request to token to use; check response diffs between valid/invalid emails; test token replay after consumption. Medium to High (enumeration=Medium, token-reuse=High, account-takeover=Critical when chained to known-email).

63

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-forgot-password/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A self-contained, action-oriented hunting skill with concrete steps, explicit proof criteria as validation checkpoints, and clean section structure; its main weakness is mild redundancy between the priority-pattern and vulnerability-class sections.

Suggestions

Collapse the overlap between 'Autonomous Testing Priority' patterns and 'Vulnerability Classes' into a single unified structure to reduce redundancy.

Add one or two literal HTTP request examples (curl/httpie) with a representative endpoint path to lift actionability from concrete-instruction to copy-paste-ready.

Make the validation/proof criteria visually consistent (e.g., a 'Confirm:' line per pattern) so every workflow step has an explicit checkpoint.

DimensionReasoningScore

Conciseness

Largely lean and concrete with numbered steps and example values, but the 'Vulnerability Classes' section overlaps with the 'Autonomous Testing Priority' patterns, adding mild redundancy that could be tightened.

4 / 5

Actionability

Provides concrete executable guidance (specific POST actions, example emails like nonexistent@fakedomain12345.com, 10-20 rapid submissions, comparison criteria); minor gaps include no literal HTTP command examples or exact endpoint names.

4 / 5

Workflow Clarity

Patterns are sequenced with numbered steps and explicit Proof/validation criteria ('enumeration is confirmed when the two responses differ measurably'; 'second successful use of a consumed token'), and the batch rate-limit test carries its own 429/lockout/CAPTCHA pass-fail checkpoint.

4 / 5

Progressive Disclosure

Well-organized into clear sections (Autonomous Testing Priority, Vulnerability Classes, Related Skills) with no bundle files needed; a touch over the 50-line simple-skill threshold and the Related Skills section provides cross-skill navigation.

4 / 5

Total

16

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-bounded description that enumerates concrete vulnerability patterns and distinguishes itself from related skills, weakened only by the absence of an explicit 'Use when...' trigger clause.

Suggestions

Add an explicit 'Use when...' trigger clause, e.g. 'Use when testing a forgot-password / account-recovery flow for broken-auth primitives.'

Add a couple of natural synonyms ('lost password', 'password recovery') to broaden trigger-term coverage.

Trim the parenthetical sibling-skill disambiguation slightly so the opening focuses on the skill's own purpose.

DimensionReasoningScore

Specificity

Lists five distinct concrete patterns with specifics (response diffs for valid/invalid email, token in API response, token replay, IP/browser binding, no rate limit) plus a Detection method — comprehensive coverage of concrete actions.

5 / 5

Completeness

The 'what' is clear and detailed (5 patterns + detection steps) but there is no explicit 'Use when...' clause or equivalent trigger guidance; per rubric guidance a missing 'when' caps completeness at 3.

3 / 5

Trigger Term Quality

Includes natural terms a user would say ('Forgot Password', 'Account Recovery', 'reset token', 'password reset', 'username enumeration') but is somewhat jargon-heavy and misses common synonyms like 'lost password'.

4 / 5

Distinctiveness Conflict Risk

Explicitly draws boundaries against sibling skills ('distinct from reset-email host-header poisoning (hunt-host-header)' and 'hunt-ato owns...'), giving it a clear niche with minimal conflict risk.

5 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.