hunt-nodejs

Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/eval injection, template engine SSTI (EJS/Pug/Handlebars), path traversal in file servers, require() injection, environment variable exfil via /proc/self/environ. Use when target runs Node.js/Express/Fastify/NestJS/Koa.

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tightly written, highly actionable Node.js exploitation playbook with clear phased sequencing and inline validation checkpoints. Its main weakness is progressive disclosure: all detail lives inline in one long SKILL.md with no reference files to offload the heavier payload libraries.

Suggestions

Move the large template-engine SSTI payloads (EJS/Pug/Handlebars) and the Phase 3 RCE sink payloads into a references/ file (e.g. PAYLOADS.md), keeping SKILL.md as an overview that links one level deep.

Add an inline validation checkpoint inside the Phase 4 rate-limit loop (e.g. break/confirm when HTTP codes stop changing) rather than relying only on the end-of-document Validation section for that batch operation.

Add a short "Prerequisites / setup" note defining $TARGET and COLLAB_HOST (Interactsh) at the top so the copy-paste commands are fully self-contained.

Dimension	Reasoning	Score
Conciseness	The body is dense with executable curl commands and signal-oriented comments ("Confirms Express.js", "Runtime detected") with no re-explanation of Node.js concepts, matching the lean-and-efficient anchor; it is not the level below because there is no padded prose to tighten.	3 / 3
Actionability	Nearly the entire body is copy-paste-ready curl commands with concrete payloads (e.g. the EJS RCE payload and __proto__ sink injections), satisfying the fully-executable anchor; placeholders like $TARGET and COLLAB_HOST are standard and do not make it merely pseudocode.	3 / 3
Workflow Clarity	A clearly sequenced Phase 1–7 flow with inline confirmation steps ("Confirm pollution: does a subsequent request reflect the polluted key?", "OOB confirmation", "Test basic: <%= 7*7 %> should return 49") plus a dedicated Validation section, meeting the explicit-validation anchor; it is not 2 because checkpoints are present rather than merely implied.	3 / 3
Progressive Disclosure	The skill is a monolithic ~210-line single file with no bundle files and no one-level-deep references, so content that could be split (large SSTI/RCE payload libraries) lives inline; it is above 1 because sections are well-organized, but below 3 because nothing is split out for navigation.	2 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-triggered description that names concrete Node.js vulnerability chains and gives an explicit "Use when" clause tied to recognizable stacks. It uses action voice rather than first/second person and is concise rather than padded.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete vulnerability chains — "Prototype Pollution → RCE chains (lodash/merge/assign)", "Express trust proxy misconfiguration", "child_process/eval injection", "template engine SSTI (EJS/Pug/Handlebars)", "require() injection", "env exfil via /proc/self/environ" — matching the anchor for many specific concrete actions.	3 / 3
Completeness	Explicitly answers both what ("Hunt Node.js specific vulnerabilities" + enumerated chains) and when ("Use when target runs Node.js/Express/Fastify/NestJS/Koa."), matching the explicit-trigger anchor.	3 / 3
Trigger Term Quality	Natural stack and bug-class terms a user would actually say (Node.js, Express, Fastify, NestJS, Koa, Prototype Pollution, SSTI, RCE) are well covered, satisfying the good-coverage anchor.	3 / 3
Distinctiveness Conflict Risk	Scoped tightly to Node.js vulnerability hunting with distinct stack-based triggers, making conflict with other skills unlikely; it is not the level below because the niche and triggers are unambiguous rather than merely "somewhat specific".	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-nodejs/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.