hunt-grpc

Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway transcoding injection, and HTTP/2 Rapid Reset DoS (CVE-2023-44487). Use when target exposes port 50051 / 443 / 8443 / 9090 with HTTP/2, when grpcurl/grpcui detects reflection, when an Envoy or grpc-gateway proxy is fronting a microservice, or when recon reveals a microservice architecture.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable and workflow-clear, with strong validation discipline and real executable tooling throughout. Its main weakness is progressive disclosure: it is a monolithic single-file skill with no external references and several long sections that could be split out.

Suggestions

Move the Phase 6 gRPC-Web/grpc-gateway transcoding details and the Phase 7 Rapid Reset section into separate referenced files (e.g., TRANSCODING.md, RAPID-RESET.md), keeping SKILL.md a lean overview with one-level-deep links, to raise progressive disclosure toward a 3.

Tighten the prose in the Crown Jewels rationale and the per-phase 'Why this matters' paragraphs to compress explanation without losing the architectural context, improving conciseness toward a 3.

Consider a short bundle file for the long Chain Table plus related-skills cross-references so the main flow stays scannable while escalation paths remain discoverable.

Dimension	Reasoning	Score
Conciseness	It is dense with executable commands and avoids explaining what gRPC is, but the Crown Jewels rationale, 'Why this matters' paragraphs, and the verbose Rapid Reset section add explanation that could be tightened — efficient but not maximally lean.	2 / 3
Actionability	Every phase ships copy-paste-ready, executable commands — real grpcurl invocations, a correct gRPC-Web frame-building snippet using protoscope/xxd, protoc descriptor-set builds, and concrete curl examples with correct content-types — fully executable rather than pseudocode.	3 / 3
Workflow Clarity	Phases are clearly sequenced 1–7 with per-phase purpose, and the Validation section provides explicit feedback loops — gating on grpc-status 0, closing candidates on Unauthenticated/PermissionDenied, re-running with grpcurl -v, and an authorization gate plus version-match check before any DoS test.	3 / 3
Progressive Disclosure	No bundle files exist and all content is inline in a single large (~265 line) SKILL.md; sections are well-headed, but long blocks like the Phase 6 transcoding details and Rapid Reset rationale are inline that could be split into referenced files, so it does not reach the well-signaled one-level-deep reference anchor.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and complete: it enumerates concrete gRPC vulnerability classes and pairs them with explicit, natural use-when conditions keyed to ports, tooling, and architecture cues. It is clearly distinct from sibling security skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'server reflection enabled (enumerate all services/methods)', 'missing authentication / metadata-stripping on internal endpoints', 'plaintext gRPC over HTTP/2', 'proto file leakage', 'gRPC-Web/grpc-gateway transcoding injection', and 'HTTP/2 Rapid Reset DoS' — matching the multiple-specific-actions anchor rather than the domain-plus-some-actions anchor.	3 / 3
Completeness	Explicitly states both what it does (the named vulnerability classes) and when to use it via the 'Use when target exposes port 50051... or when recon reveals a microservice architecture' clause with multiple concrete triggers.	3 / 3
Trigger Term Quality	Covers natural user phrasing — 'gRPC vulnerabilities', 'port 50051 / 443 / 8443 / 9090', 'grpcurl/grpcui detects reflection', 'Envoy or grpc-gateway proxy', 'microservice' — with varied common variations, exceeding the some-relevant-keywords-but-missing-variations anchor.	3 / 3
Distinctiveness Conflict Risk	The gRPC-specific niche anchored by named ports, tooling, and a CVE gives it distinct triggers unlikely to fire for a sibling skill, despite overlapping the security-testing space with related hunt-* skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-grpc/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.