hunt-laravel

Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard unauthorized access, Ignition RCE (CVE-2021-3129), Signed URL manipulation, Queue Worker abuse, mass assignment via Eloquent, deserialization via cookies, .env file exposure. Use when target runs Laravel (PHP) — detected via X-Powered-By, Laravel session cookies, or /storage/ paths.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is a lean, highly actionable Laravel pentest playbook with a clear phased structure and a validation section. Its main gaps are an incomplete cookie-forging chain (commented-out, unbundled script), absent error-recovery feedback loops with only end-of-document validation, and a monolithic layout that a multi-vulnerability playbook of this length could split into reference files.

Suggestions

Bundle the laravel_cookie_forge.py script (or provide the exact APP_KEY signing commands) and uncomment the Phase 7 forge step so the cookie-deserialization chain is fully executable instead of a commented-out placeholder.

Add inline pass/fail checkpoints and a short 'if validation fails, adjust X and retry' note within each exploitation phase, rather than consolidating all success criteria in a trailing Validation section.

Extract each vulnerability class's detailed exploitation steps into one-level-deep reference files (e.g. references/ignition-rce.md, references/signed-urls.md) and keep SKILL.md as a concise overview with clearly signaled links, reducing the monolithic 200-line body.

Dimension	Reasoning	Score
Conciseness	The body is a dense, command-focused playbook with no explanation of concepts Claude already knows; the Crown Jewel list and Chain Table restate phase content but each adds a distinct lens (priority ranking / chain-to relationships), so tokens earn their place rather than being padded as in the anchor-2 example.	3 / 3
Actionability	Six of seven phases are copy-paste-ready curl with real payloads, but Phase 7's cookie forging relies on a commented-out, unbundled 'laravel_cookie_forge.py' ('# python3 laravel_cookie_forge.py ...'), so the skill is not 'fully' executable and misses key details for that chain — matching the anchor-2 'incomplete / missing key details' bar below the anchor-3 'fully executable' standard.	2 / 3
Workflow Clarity	There is a clear seven-phase sequence with inline conditional gates ('If Whoops/Ignition is visible → debug mode ON → test CVE-2021-3129') and a final Validation checklist, but there are no explicit error-recovery feedback loops ('if this fails, adjust and retry') and validation lives in a separate end section rather than as inline pass/fail checkpoints within each phase, placing it at anchor 2 rather than the anchor-3 gate pattern.	2 / 3
Progressive Disclosure	The body is well-organized into phased sections, but it is entirely monolithic with no bundle files and spans ~200 lines across seven distinct vulnerability classes — exceeding the 'under 50 lines / single task' threshold, so the simple-skill exception does not apply and per-vulnerability deep-dives could be split into one-level-deep reference files (anchor 2: 'content that should be separate is inline').	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific, well-triggered, and clearly distinct: it enumerates concrete Laravel vulnerabilities and pairs them with an explicit 'Use when' clause grounded in detection signals. It does not over-claim or pad, and uses acceptable imperative voice matching the reference good examples.

Dimension	Reasoning	Score
Specificity	Lists eight concrete vulnerabilities to hunt (Ignition RCE, Telescope/Horizon access, signed URL manipulation, Queue Worker abuse, mass assignment, cookie deserialization, .env exposure), matching the 'lists multiple specific concrete actions' anchor rather than the domain-only anchor 2.	3 / 3
Completeness	Explicitly states both what it does (the enumerated Laravel vulnerabilities) and when to use it via a 'Use when target runs Laravel (PHP) — detected via...' clause, satisfying the 'clearly answers both what AND when' anchor.	3 / 3
Trigger Term Quality	Covers the natural term 'Laravel' (plus 'PHP', 'vulnerabilities') alongside concrete detection triggers ('X-Powered-By', 'Laravel session cookies', '/storage/ paths') that a tester would actually say; not reduced to 2 because common variations are present rather than only jargon.	3 / 3
Distinctiveness Conflict Risk	The niche is sharply Laravel-specific with distinct detection triggers, making it unlikely to fire for a non-Laravel skill; clear of the overlap risk at anchor 2.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-laravel/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.