hunt-oauth

Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-oauth/SKILL.md

Quality

Content

73%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete commands and a well-sequenced, validated hunting workflow, but it is monolithic: a single ~400-line file with citation catalogs, narrative scenarios, and reference tables inlined rather than split into referenced files. Splitting the heavier reference material into referenced files would materially improve both conciseness and progressive disclosure.

Suggestions

Move the "Disclosed Report Citations" catalog and "Real Impact Examples" into separate referenced files (e.g. references/citations.md and references/impact-scenarios.md) and link to them from a short summary, reducing the inline token cost.

Extract the redirect_uri bypass table and bypass-techniques section into references/bypass-catalog.md, keeping only the operational rule inline in SKILL.md.

Trim narrative padding in scenario descriptions to a one-line impact statement plus a link, preserving actionability while cutting verbosity.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and tightly written, but the ~400-line body inlines lengthy report-citation catalogs, three full narrative "Real Impact" scenarios, and a large bypass table that pad the token budget beyond what a hunting skill's core instructions require.	3 / 5
Actionability	Fully executable throughout: copy-paste curl, adb, and jq commands; concrete redirect_uri and CSRF payloads; OIDC discovery and dynamic-registration abuse commands covering the common cases.	5 / 5
Workflow Clarity	A clear 10-step hunting methodology with an explicit Gate 0 validation checkpoint ("Run gate 0 check before reporting") and reproduce-in-10-minutes feedback loop for error recovery before reporting.	5 / 5
Progressive Disclosure	No bundle files exist and the entire skill is a single monolithic file; content that clearly belongs in separate references (the 10-entry citation catalog, impact scenarios, bypass table) is inlined with no one-level-deep references or navigation.	2 / 5
	Total	15 / 20 Passed

Description

57%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description answers both what and when and occupies a clear OAuth-hunting niche, but the capability statement is thin (a single generic verb) and the trigger phrasing lacks concrete OAuth-specific keywords. Adding two or three concrete actions and richer trigger terms would lift specificity and trigger-term quality.

Suggestions

Replace the generic verb "Hunting skill for oauth vulnerabilities" with concrete actions, e.g. "Tests redirect_uri validation, state/CSRF, nonce replay, and mobile deep-link OAuth handlers."

Expand the trigger clause with natural OAuth keywords: "Use when testing OAuth/OIDC flows, redirect_uri bypass, account takeover via social login, or mobile deep-link callbacks."

Drop or relocate the provenance line ("Built from 19 public bug bounty reports") from the description into the body so the description focuses on capability and trigger.

Dimension	Reasoning	Score
Specificity	Names the domain ("oauth vulnerabilities") and provenance ("Built from 19 public bug bounty reports") but the only action stated is the generic verb "Hunting"; no concrete actions like redirect_uri testing or state/CSRF checks are listed.	2 / 5
Completeness	Provides both a "what" ("Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports") and an explicit "when" ("Use when hunting oauth on any target"), though the trigger clause is generic rather than concrete.	4 / 5
Trigger Term Quality	Includes relevant natural terms ("oauth", "bug bounty", "hunting", "any target") but misses common variations and synonyms users would say, such as redirect_uri, account takeover, OAuth flows, or OIDC.	3 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (OAuth-specific hunting) with distinct triggers; minor overlap risk only with adjacent generic hunting skills.	4 / 5
	Total	13 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-oauth/SKILL.md
Commit: a3ea443

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.