CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-grpc

Hunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway transcoding injection, and HTTP/2 Rapid Reset DoS (CVE-2023-44487). Use when target exposes port 50051 / 443 / 8443 / 9090 with HTTP/2, when grpcurl/grpcui detects reflection, when an Envoy or grpc-gateway proxy is fronting a microservice, or when recon reveals a microservice architecture.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, actionable gRPC hunting playbook with executable commands, a clear phased workflow, and strong false-positive validation discipline. Its main weakness is token efficiency and the absence of progressive disclosure: the full methodology is inlined in one file with no supporting bundle references.

Suggestions

Tighten the 'Crown Jewel Targets' preamble and the per-phase rationale paragraphs to the minimum needed to drive decisions; some explanatory context restates points already made in the Validation section.

Extract the Chain Table and/or the detailed proto-rebuild and gRPC-Web framing recipes into reference files under references/ (e.g. CHAINS.md, GRPC-WEB-FRAMING.md) and link to them one level deep, so SKILL.md reads as an overview.

Move the per-tool usage notes in the Tools section into a scripts/ or references/TOOLS.md, keeping only a one-line pointer for each tool inline.

DimensionReasoningScore

Conciseness

Mostly efficient: the prose is largely non-obvious security judgment (status-code interpretation, why h2load cannot test rapid-reset, metadata-stripping mechanics) rather than concepts Claude already knows, but the ~270-line body has a few explanatory paragraphs (e.g. the 'Crown Jewel Targets' preamble) that could be trimmed. It sits clearly above the 'mostly efficient with some unnecessary explanation' anchor but is not fully lean.

4 / 5

Actionability

Provides copy-paste-ready, executable commands throughout — nmap/openssl ALPN probes, grpcurl list/describe/call invocations, a complete protoscope-to-gRPC-Web framing recipe, and curl-based transcoded-route tests — covering the common cases with concrete tooling rather than pseudocode.

5 / 5

Workflow Clarity

Clear seven-phase sequence with explicit validation checkpoints: the dedicated 'Validation — false-positive discipline' section defines feedback loops (status-code discrimination, re-run with grpcurl -v, authenticated-vs-unauthenticated state delta), and Phase 7 carries an authorization gate plus 'version-match instead of flooding' recovery guidance. Because validation is present for the destructive DoS and batch IDOR steps, the workflow-clarity cap of 3 does not apply.

5 / 5

Progressive Disclosure

Well-organized with clearly signaled section headers (per-phase '##' headings, Chain Table, Tools, Validation) and easy in-file navigation, but no bundle files exist under references/scripts/assets and the entire ~270-line playbook is inlined in SKILL.md rather than split into one-level-deep reference files. This places it above 'content that should be separate is inline' but short of the 'overview pointing to detailed materials' ideal.

4 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A high-quality, third-person description that pairs a concrete enumeration of gRPC vulnerability classes with an explicit, multi-condition 'Use when' trigger clause. It is specific, trigger-rich, and clearly distinguishable from adjacent security skills.

DimensionReasoningScore

Specificity

Lists multiple specific concrete vulnerability classes — 'server reflection enabled (enumerate all services/methods)', 'missing authentication / metadata-stripping on internal endpoints', 'plaintext gRPC over HTTP/2', 'gRPC-Web/grpc-gateway transcoding injection', and 'HTTP/2 Rapid Reset DoS (CVE-2023-44487)' — giving comprehensive coverage rather than a vague domain label.

5 / 5

Completeness

Explicitly answers both what (a concrete list of gRPC vulnerability classes to hunt) and when, via the 'Use when target exposes port 50051 / 443 / 8443 / 9090 with HTTP/2, when grpcurl/grpcui detects reflection, when an Envoy or grpc-gateway proxy is fronting a microservice, or when recon reveals a microservice architecture' trigger clause.

5 / 5

Trigger Term Quality

Includes natural user-facing terms and synonyms across tooling, ports, and architecture — 'gRPC', 'port 50051 / 443 / 8443 / 9090', 'HTTP/2', 'grpcurl/grpcui detects reflection', 'Envoy or grpc-gateway proxy', and 'microservice architecture'.

5 / 5

Distinctiveness Conflict Risk

Occupies a clear gRPC-security niche with distinct triggers (grpcurl/grpcui, grpc-gateway, HTTP/2 ALPN, microservice recon) that would not plausibly fire for unrelated skills, keeping conflict risk minimal.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.