hunt-nextjs

Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF (/_next/image), RSC payload leakage, getServerSideProps injection, source map exposure, debug endpoint leakage. Use when target runs Next.js 13/14/15 or any React SSR framework.

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, highly actionable Next.js hunting playbook with executable commands and strong validation/feedback guidance that guards against false positives. Its only weakness is progressive disclosure: the entire reference is a single long inline file rather than an overview pointing to one-level-deep reference files.

Suggestions

Split the longer phases (e.g. Phase 4 Image SSRF, Phase 6 ISR poisoning) into one-level-deep reference files and keep SKILL.md as an overview with 'See X.md' links, improving progressive disclosure.

De-duplicate the build-ID extraction shown in both the intro and Phase 1 to tighten conciseness.

Consider moving the FALSE-POSITIVE GUARD and precondition notes into a shared 'Validation & false-positive guide' reference so each phase stays scannable.

Dimension	Reasoning	Score
Conciseness	The body is command-driven (curl/grep/python one-liners) with no basic-concept padding; its longer passages are non-obvious false-positive guards that earn their tokens rather than restating what Claude already knows.	3 / 3
Actionability	Every phase provides fully executable commands with real flags, headers (e.g. 'Next-Action'), multipart bodies, and $TARGET/$BUILD_ID interpolation, making the examples copy-paste ready.	3 / 3
Workflow Clarity	A clear phased sequence (fingerprint through env-var leak) with an explicit Validation section and feedback loops (FALSE-POSITIVE GUARD in Phase 4, the Phase 7 precondition, unique-marker checks in Phase 6) that prevent false claims.	3 / 3
Progressive Disclosure	It is a single ~240-line self-contained playbook with no bundle/reference files and everything inline; sections are well-labeled, but the content could be split into per-phase reference files, which is the score-2 'content that should be separate is inline' pattern.	2 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, third-person description that names concrete vulnerability classes and pairs them with an explicit 'Use when' trigger tied to Next.js versions and React SSR. It cleanly answers both what and when with low conflict risk.

Dimension	Reasoning	Score
Specificity	The description names multiple concrete vulnerability classes ("Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF (/_next/image)") rather than vague actions, matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	It explicitly states both what (hunt eight named Next.js vulnerability classes) and when ("Use when target runs Next.js 13/14/15 or any React SSR framework"), matching the explicit-trigger anchor and avoiding the cap.	3 / 3
Trigger Term Quality	Natural terms a pentester would actually say are well covered ("Next.js", "Server Actions", "SSRF", "Middleware auth bypass", "React SSR"), with only minor jargon like "RSC payload leakage" that practitioners still use.	3 / 3
Distinctiveness Conflict Risk	The niche is tightly scoped to Next.js/SSR-specific vulns with a distinct version/framework trigger, making it unlikely to fire for a generic web or non-Next skill.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-nextjs/SKILL.md
Commit: 6b9c96e

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.