hunt-open-redirect

Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta refresh, header injection. Use when hunting redirect bugs or building ATO chains.

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

87%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is lean, highly actionable, and well-organized for a self-contained single-file skill. Its only weakness is workflow clarity: the phased hunting process lacks per-phase validation checkpoints for the batch parameter-testing step.

Suggestions

Add an explicit validation gate after Phase 2's batch loop (e.g., 'Confirm at least one 302 Location points to your controlled domain before proceeding to bypass testing') to turn the trailing Validation section into inline checkpoints.

Insert a feedback loop between Phase 3 (bypass) and Phase 4 (OAuth chain) — e.g., 'If no bypass payload produced a redirect, stop; if one did, carry it into the OAuth redirect_uri test.'

Clarify what counts as a confirmed finding before moving from discovery (Phase 1) to active testing (Phase 2), so the batch operation has a clear entry condition.

Dimension	Reasoning	Score
Conciseness	Dense, table-driven body with no padding — 'Open redirect alone is Low. Chained to OAuth = Critical (ATO).' — that assumes Claude already knows what redirects, curl, and OAuth are, so every token earns its place.	3 / 3
Actionability	Provides fully executable, copy-paste-ready commands — 'cat recon/$TARGET/urls.txt \| gf redirect', 'qsreplace "$COLLAB"', 'openredirex -l ... -p evil.com', 'nuclei -u ... -t redirect/' — plus concrete payload arrays and a bypass table.	3 / 3
Workflow Clarity	Phases 1–5 are clearly sequenced, but Phase 2 loops over candidate URLs as a batch operation with no per-phase validation checkpoint, and the trailing 'Validation' section is not woven into the sequence as explicit gates — which the batch-operation guideline caps at 2 rather than the 3 reserved for inline validate→fix→retry feedback loops.	2 / 3
Progressive Disclosure	No bundle files exist, so the single-file body is scored on organization; it is cleanly sectioned (Crown Jewel Targets, Attack Surface Signals, Bypass Table, Methodology, Automation, Chain Table, Validation) with no nested references, matching the well-organized-sections anchor for a self-contained skill.	3 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, complete, and distinctive; it answers both what the skill does and when to use it in third-person voice. No fluff or over-claims are present.

Dimension	Reasoning	Score
Specificity	Names multiple concrete capabilities — 'URL parameter manipulation, JavaScript redirect, meta refresh, header injection' plus 'chained to OAuth token theft → ATO, phishing chains' and 'building ATO chains', matching the multiple-specific-actions anchor.	3 / 3
Completeness	Clearly states what it does (hunt all redirect types, build ATO/phishing chains) and gives an explicit 'Use when hunting redirect bugs or building ATO chains' trigger, satisfying both what and when.	3 / 3
Trigger Term Quality	Natural hunting vocabulary is well covered — 'open redirect', 'redirect bugs', 'OAuth token theft', 'ATO', 'phishing' — terms a user would actually say, with no common variations missing.	3 / 3
Distinctiveness Conflict Risk	The open-redirect / ATO-chain niche is specific with distinct triggers ('hunting redirect bugs', 'building ATO chains') and is unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-open-redirect/SKILL.md
Commit: 6b9c96e

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.