hunt-rce

Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-rce/SKILL.md

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is exceptionally actionable and the hunting workflow is clearly sequenced with strong validation gates. Its main weaknesses are narrative prose that could be tightened and a monolithic structure with no progressive disclosure to bundle reference files despite the large volume of reference material.

Suggestions

Tighten or condense the justification/narrative sections ('Why this class pays most', 'Real Impact Examples', 'Common Root Causes') so every line is actionable hunting guidance rather than motivational context.

Split the large reference blocks (e.g. 'Payload & Detection Patterns' and 'Chains & Compositions') into bundle files such as PAYLOADS.md and CHAINS.md, leaving SKILL.md as a concise overview that links one level deep.

Dimension	Reasoning	Score
Conciseness	The body is information-dense with payloads and commands and avoids explaining concepts Claude already knows, but the narrative prose sections ('Why this class pays most', 'Real Impact Examples' scenarios, 'Common Root Causes') read as justification and could be tightened, fitting anchor-2 'mostly efficient but includes some unnecessary explanation or could be tightened'.	2 / 3
Actionability	Provides fully executable, copy-paste-ready guidance throughout — concrete curl commands, YAML gadgets, grep patterns, kubectl invocations, and bash one-liners — matching the anchor-3 'fully executable code/commands; specific examples; copy-paste ready'.	3 / 3
Workflow Clarity	The 10-step 'Step-by-Step Hunting Methodology' is clearly sequenced and backed by explicit validation checkpoints ('Gate 0 Validation' three-gate check, 'reproduced in 10 minutes', OOB callback requirement, triage-validation Reproducibility Gate), matching anchor-3 'clear sequence with explicit validation steps; feedback loops for error recovery'.	3 / 3
Progressive Disclosure	The ~494-line body is well-organized with clear section headers but is monolithic — no bundle reference files exist and large reference blocks (Chains & Compositions, Payload & Detection Patterns) that could be split out are inline, fitting anchor-2 'some structure but ... content that should be separate is inline'; it avoids anchor-1 because sections are well organized with no nested references.	2 / 3
	Total	10 / 12 Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is third-person, concise, and correctly pairs a 'what' statement with an explicit 'Use when' trigger, scoring well on completeness. It is weakened by a single generic action verb and limited trigger-term coverage that increase overlap with sibling hunt-* skills.

Suggestions

Replace the generic verb 'Hunting' with concrete enumerated actions, e.g. 'Probe command injection, test template/YAML deserialization, and hunt dependency-confusion RCE.'

Expand trigger terms to natural user phrasings such as 'remote code execution', 'command injection', and 'deserialization RCE' alongside 'rce'.

Tighten 'on any target' or add a distinguishing qualifier so the description does not compete with sibling skills (hunt-ssti, hunt-ssrf, hunt-sqli) whose chains culminate in RCE.

Dimension	Reasoning	Score
Specificity	Names the domain ('rce vulnerabilities') and a single action verb ('Hunting') plus provenance ('Built from 67 public bug bounty reports'), but does not list multiple concrete actions as the anchor-3 example does; 'hunting' is generic rather than enumerating probe/test/exploit activities.	2 / 3
Completeness	Explicitly answers both what ('Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports.') and when ('Use when hunting rce on any target.'), satisfying the anchor-3 'clearly answers both what AND when with explicit triggers'.	3 / 3
Trigger Term Quality	Includes relevant natural terms ('rce', 'bug bounty', 'hunting rce', 'target') but misses common variations a user would actually say such as 'remote code execution' or 'command injection', matching the anchor-2 'some relevant keywords but missing common variations'.	2 / 3
Distinctiveness Conflict Risk	'rce vulnerabilities' is a recognizable niche, but 'on any target' is broadening and the skill family referenced in the body (hunt-ssti, hunt-sqli, hunt-ssrf whose chains lead to RCE) creates overlap risk, fitting anchor-2 'somewhat specific but could still overlap with similar skills'.	2 / 3
	Total	9 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-rce/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.