hunt-graphql

Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across IDOR via node() / GID, mutation IDOR including AI/LLM features, cross-tenant IDOR, SSRF via argument, batching-DoS, query-cost-bypass, SQLi via argument, broken-object-level-authz, auth-bypass via unscoped mutations, and PII exposure from missing field-level authz. Use when hunting graphql on any target.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable and well-sequenced with concrete code and a validation gate, but it is a long monolithic document that does not split detail into reference files, leaving progressive disclosure and conciseness as the weak spots.

Suggestions

Compress the 'Real Impact Examples' scenarios and 'Crown Jewel Targets' intro into concise bullets — the narrative prose adds length without adding executable guidance.

Move the 'Disclosed Report Citations' list and the full Payload Pack into reference files under ./references/ and link them from SKILL.md, splitting the monolithic body and enabling one-level-deep progressive disclosure.

Fix or remove the referenced docs/verification/phase2e-jwt-graphql-race.md path — no such bundle file exists, so it is currently a dangling reference.

Dimension	Reasoning	Score
Conciseness	Most content is domain-specific and earns its place, but the narrative "Real Impact Examples" scenarios and the "Crown Jewel Targets" intro pad the body with prose that could be tightened into bullets without losing guidance.	2 / 3
Actionability	Provides copy-paste-ready, executable artifacts throughout: full and minimal introspection queries, curl introspection/RC-desync sequences, grep patterns, the clairvoyance command, batch JSON, and alias-batching fragments.	3 / 3
Workflow Clarity	A clear 10-step numbered hunting methodology is paired with an explicit "Gate 0 Validation" checklist and a step-10 deterministic-reproduction requirement, giving sequenced steps with validation checkpoints.	3 / 3
Progressive Disclosure	The body is a ~340-line monolithic SKILL.md with no bundle files; the full citation list and payload set are inline, and the referenced docs/verification/phase2e-jwt-graphql-race.md path has no corresponding bundled file.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it names a concrete niche, lists specific vulnerability subclasses, includes natural graphql/bug-bounty trigger terms, and provides an explicit "Use when" clause covering both what and when.

Dimension	Reasoning	Score
Specificity	Enumerates many concrete vulnerability subclasses ("IDOR via node() / GID", "SSRF via argument", "batching-DoS", "query-cost-bypass", "SQLi via argument", "PII exposure from missing field-level authz") rather than vague language, matching the multi-specific-action anchor.	3 / 3
Completeness	It states what the skill does ("Hunting skill for graphql vulnerabilities. Built from 12 public bug bounty reports across ...") and gives an explicit when ("Use when hunting graphql on any target."), satisfying both halves with an explicit trigger.	3 / 3
Trigger Term Quality	"graphql", "graphql vulnerabilities", "bug bounty reports", and "hunting graphql" are exactly the natural terms a user would say when needing this skill, and they are placed in a clear trigger clause.	3 / 3
Distinctiveness Conflict Risk	The graphql-specific scope and trigger carve a clear niche unlikely to fire for sibling hunting skills (e.g. hunt-idor, hunt-race-condition) which key off different triggers.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-graphql/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.