CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-nextjs

Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF (/_next/image), RSC payload leakage, getServerSideProps injection, source map exposure, debug endpoint leakage. Use when target runs Next.js 13/14/15 or any React SSR framework.

71

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tightly written, highly actionable hunting playbook with copy-paste commands, inline false-positive guards, and a validation section. Structure is clear and self-contained; the main weakness is the absence of any progressive-disclosure split for a fairly long single file.

Suggestions

Add explicit error-recovery guidance after the validation criteria (e.g., 'if SSRF callback not received, verify remotePatterns allowlist before reporting negative').

Consider moving the longer per-phase exploitation recipes into a references/ file linked from a shorter overview to reduce inline length.

DimensionReasoningScore

Conciseness

Mostly lean command-first phases that assume Claude knows curl/grep; the FALSE-POSITIVE GUARD and precondition notes earn their place as domain-specific knowledge Claude cannot reliably infer, though a few prose passages could be trimmed.

4 / 5

Actionability

Copy-paste-ready curl commands with concrete headers (Next-Action, x-middleware-subrequest), specific paths (/_next/image, /_next/data/BUILD_ID), and clearly marked variables ($TARGET, $BUILD_ID, ACTION_ID_HERE) covering the common exploitation cases.

5 / 5

Workflow Clarity

Eight phases are sequenced (fingerprint first, then per-surface exploitation) with a closing Validation section of ✅ confirmation criteria and inline false-positive guards; minor gaps in explicit error-recovery loops between phases.

4 / 5

Progressive Disclosure

Well-organized into clearly headed phases with no nested references and no bundle files present; everything is inline in a ~256-line file, which is defensible for a single-playbook hunting skill though some phases could theoretically be split into reference files.

4 / 5

Total

17

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-triggered description that names concrete vulnerability classes and an explicit 'Use when' clause tied to Next.js versions and React SSR frameworks. Only minor gap: lacks broader pentest/security-testing synonyms a user might say.

Suggestions

Consider adding a broader trigger synonym such as 'security testing' or 'pentest' so users who phrase the need generically still surface this skill.

DimensionReasoningScore

Specificity

Lists eight concrete vulnerability classes (Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF, RSC payload leakage, getServerSideProps injection, source map exposure, debug endpoint leakage) — comprehensive coverage of specific actions.

5 / 5

Completeness

Explicitly answers both what ('Hunt Next.js specific vulnerabilities — ...') and when ('Use when target runs Next.js 13/14/15 or any React SSR framework') with concrete trigger phrases.

5 / 5

Trigger Term Quality

Strong natural terms a user would say ('Next.js', 'SSRF', 'Server Actions', 'React SSR framework', 'Next.js 13/14/15'), but misses broader pentest synonyms like 'security testing' or 'pentest Next.js' that a user might naturally utter.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear, narrow niche (Next.js/SSR-framework vulnerability hunting) with distinctive triggers; minimal overlap risk with general web-hunt skills.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.