hunt-lfi

Hunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning → RCE, PHP filter-chain RCE (no upload needed), php:// / data:// / zip:// / phar:// wrappers, RFI via allow_url_include, directory traversal read/write/delete. Covers OOB/blind LFI confirmation and false-positive discipline. Use when hunting file-include or path-traversal bugs on any target.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable and methodologically rigorous with strong validation discipline, but the single-file body is long and duplicates confirmation guidance across two sections. The absence of any bundle files means large reference tables live inline rather than being progressively disclosed.

Suggestions

Move the Sensitive Files list, Bypass Table, and Chain Table into a references/ file (e.g. REFERENCES.md) and link to it from the body to apply progressive disclosure and trim the main SKILL.md.

Consolidate the OOB/blind confirmation guidance that currently appears in both 'OOB/Blind-LFI Confirmation Gate' and 'Validation Discipline' into one section to remove duplication.

Trim restated bypass techniques (Phase 2 payloads vs the Bypass Table) so each technique appears once.

Dimension	Reasoning	Score
Conciseness	The body is information-dense and avoids explaining basics Claude already knows, but it is long and repeats some guidance — the OOB confirmation material appears in both 'OOB/Blind-LFI Confirmation Gate' and again in 'Validation Discipline', and bypass techniques are restated across Phase 2 and the Bypass Table.	3 / 5
Actionability	Phases 2–9 give copy-paste-ready bash/curl payloads, exact wrapper syntax, real tool invocations (ffuf, dotdotpwn, php_filter_chain_generator.py), and a concrete default workflow with Collaborator sub-tagging.	5 / 5
Workflow Clarity	Sequenced Phase 1→9 with an explicit confirmation gate ('Read First'), validation checkpoints, and a feedback loop that mandates retracting unconfirmed claims before reporting — exactly the validate→fix→retry discipline the rubric rewards for destructive/batch-style hunting.	5 / 5
Progressive Disclosure	No references/, scripts/, or assets/ bundles exist, yet the skill is ~260 lines with large lookup tables (Sensitive Files, Bypass Table, Chain Table, CVE list) that are prime candidates for offloaded reference files; structure is monolithic with everything inlined and no one-level-deep references.	2 / 5
	Total	15 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and clearly states both capabilities and when to invoke the skill. It is dense but every clause carries concrete signal rather than fluff. Voice is third person throughout.

Dimension	Reasoning	Score
Specificity	Lists many concrete actions — '/etc/passwd read, log poisoning → RCE, PHP filter-chain RCE', wrappers (php://, data://, zip://, phar://), 'RFI via allow_url_include', and 'directory traversal read/write/delete' — with comprehensive coverage of the LFI/RFI/path-traversal surface.	5 / 5
Completeness	Explicitly answers both 'what' (the enumerated techniques) and 'when' via the closing trigger clause 'Use when hunting file-include or path-traversal bugs on any target.'	5 / 5
Trigger Term Quality	Covers natural terms users would say — 'file-include', 'path-traversal', 'LFI', 'RFI' — plus concrete technical synonyms and file/wrapper names, giving comprehensive keyword coverage.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (file-include/path-traversal hunting) with distinct trigger phrasing and a specific technique list, minimizing overlap with adjacent skills like file-upload or SSRF hunting.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-lfi/SKILL.md
Commit: 58017df

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.