hunt-ldap

Hunt LDAP Injection and XPath Injection — authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath bypass. Covers the LDAP special-character set (* ( ) \ NUL /), search-filter-context vs DN-injection, parenthesis-balancing, AND/OR filter logic, and {SSHA}/{CRYPT} userPassword exfil on non-AD directories. Use when target uses LDAP/AD authentication, corporate SSO with a directory backend, an address-book/people-search API, or XML-based data stores queried with XPath.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable and methodologically clear with strong validation discipline, but the single large monolithic file with repeated caveats and some basic grammar explanation leaves room for tightening and file-level disclosure.

Suggestions

Move the repeated AD-vs-generic-LDAP warning into one canonical section and reference it rather than restating it in the chain table and validation checklist, to cut redundancy.

Factor the payload libraries (auth-bypass, XPath, blind-exfil char sets) and the chain table into a references/ file linked from a shorter overview, enabling one-level-deep progressive disclosure.

Trim the basic filter-grammar primer (`&`/`|`/`!` and Polish-notation explanation) to the injection-relevant essentials, since Claude already knows LDAP operator semantics.

Dimension	Reasoning	Score
Conciseness	The body is dense and largely expert-valuable, but it explains grammar Claude already knows ("`&` = AND, `\|` = OR, `!` = NOT", prefix/Polish notation) and repeats the AD-vs-generic warning three times (CRITICAL section, chain-table note, validation checklist), so it could be tightened rather than earning the lean level-3 anchor.	2 / 3
Actionability	Phases 1–6 provide fully executable bash/curl with concrete payload arrays, a working oracle function, and char-set loops — copy-paste ready and matching the level-3 anchor of specific, executable examples.	3 / 3
Workflow Clarity	A clearly sequenced Phase 1–6 methodology with explicit validation checkpoints and a dedicated "Validation — rule out the false positive BEFORE you report" checklist containing feedback loops (repeat 3x, negative control still FALSE, paren-removal proof), exactly the level-3 pattern.	3 / 3
Progressive Disclosure	Sections are well-organized, but the skill is a single ~300-line monolithic file with no bundle files (references/scripts/assets absent) and no one-level-deep references; the under-50-lines exception does not apply, so it sits at the level-2 anchor of inline content that could be split rather than the level-3 split-with-navigation pattern.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names concrete capabilities and pairs them with explicit, natural-language trigger conditions. Voice is appropriately third-person/imperative ("Hunt...", "Use when...") with no first/second-person slippage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "authentication bypass, blind char-by-char attribute exfiltration, AD user/group enumeration, XML-store XPath bypass" — plus specific technique details (special-character set, parenthesis-balancing, {SSHA}/{CRYPT} exfil), matching the level-3 anchor of multiple specific concrete actions.	3 / 3
Completeness	It explicitly answers both "what" (the named attack actions and technique coverage) and "when" via an explicit "Use when target uses..." trigger clause, matching the level-3 anchor that clearly answers both what AND when.	3 / 3
Trigger Term Quality	The "Use when" clause surfaces natural phrases a user would actually say — "LDAP/AD authentication", "corporate SSO with a directory backend", "address-book/people-search API", "XML-based data stores queried with XPath" — giving good coverage of common variations rather than only technical jargon.	3 / 3
Distinctiveness Conflict Risk	It carves a clear, narrow niche (LDAP and XPath injection specifically) with distinct triggers unlikely to fire for unrelated skills; it would not reasonably conflict with general web-app or SQL-injection skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-ldap/SKILL.md
Commit: 6b9c96e

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.