hunt-open-redirect

Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta refresh, header injection. Use when hunting redirect bugs or building ATO chains.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

90%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, token-efficient hunting playbook with executable commands and payload tables. Workflow clarity and progressive disclosure are strong but not maximal due to limited per-phase validation loops and no bundle split.

Suggestions

Add an explicit per-phase validation/feedback loop (e.g. 'if no Location header points to evil.com, proceed to Phase 3 bypasses') to lift workflow clarity.

Consider moving the Bypass Table and Chain Table into a references/ file referenced from the body to improve progressive disclosure for this longer skill.

Add a brief 'triage before deep testing' checkpoint in Phase 2 to confirm a parameter reflects user input before running the full bypass suite.

Dimension	Reasoning	Score
Conciseness	Lean throughout — parameter lists, payload tables, and copy-paste bash with no padding or re-explanation of concepts Claude already knows; every token earns its place.	5 / 5
Actionability	Every phase provides fully executable, copy-paste-ready bash commands plus a concrete bypass payload table and automation tool invocations covering the common cases.	5 / 5
Workflow Clarity	Phases 1–5 are clearly sequenced with a terminal Validation section, but batch URL testing lacks per-phase feedback loops (e.g. confirm-then-iterate), leaving minor validation gaps.	4 / 5
Progressive Disclosure	Single well-organized file with clear section headers and no nested references; at ~170 lines it exceeds the under-50-line simple-skill exception, so a couple of tables could be split out, but placement is sound.	4 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names concrete redirect types and chaining outcomes and provides an explicit 'Use when' trigger. Minor room to broaden natural trigger synonyms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete action types — 'URL parameter manipulation, JavaScript redirect, meta refresh, header injection' — plus chaining paths (OAuth token theft, phishing), giving comprehensive coverage of the redirect-hunting domain.	5 / 5
Completeness	Explicitly answers both what (hunt all redirect types and chains) and when ('Use when hunting redirect bugs or building ATO chains') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Natural trigger phrases like 'hunting redirect bugs', 'building ATO chains', and 'OAuth token theft' are present, but a few common synonyms (e.g. 'open redirect vulnerability', 'URL redirect') are missing.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (open redirect hunting / ATO chaining) with distinct triggers and minimal overlap risk against other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-open-redirect/SKILL.md
Commit: 58017df

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.