CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-session

Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token rotation/reuse-detection gaps, OAuth/SSO session linkage, device-bound-session (DBSC) downgrade, and cookie attribute issues (Secure/HttpOnly/SameSite/__Host-). Validate with TWO real sessions (attacker A + victim B), body-diff every 200, and OOB confirmation for theft chains. Medium to Critical (fixation→admin hijack, no-invalidation→persistent ATO).

66

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-session/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced hunting methodology with strong validation discipline and copy-paste-ready code. It is held back only by duplicated priority-pattern content and the absence of any file-level progressive disclosure for a large topic.

Suggestions

Remove or sharply condense the top 'Autonomous Testing Priority' Patterns 1-3 block, since Phases 1-3 already elaborate the same flows with executable code.

Split the per-phase methodology (or the chain table and entropy/JWT analysis) into reference files linked from a concise SKILL.md overview to add one-level-deep progressive disclosure.

Consolidate the repeated FP-discipline notes into the single closing Validation section rather than restating body-diff/negative-control in every phase.

DimensionReasoningScore

Conciseness

Mostly efficient and task-specific with no generic concept explanations, but the top 'Autonomous Testing Priority' block (Patterns 1-3) duplicates Phases 1-3 and FP discipline is restated in both per-phase callouts and the closing Validation section, so it could be tightened.

2 / 3

Actionability

Provides fully executable bash (a robust get_cookie helper, copy-paste curl flows per phase, jq/entropy loops) with explicit decision rules like 'If $POST == $PRE ... -> FIXATION', matching the copy-paste-ready anchor.

3 / 3

Workflow Clarity

Eight phases are clearly sequenced with explicit validation checkpoints (body-diff vs baseline, garbage-cookie negative control, cache/edge check, OOB) and feedback loops, plus a final Validation checklist with severity gates.

3 / 3

Progressive Disclosure

Well organized into clear sections but monolithic at ~290 lines with no bundle files or one-level-deep references; the per-phase detail and chain table could reasonably be split into reference files for a topic this size.

2 / 3

Total

10

/

12

Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description rich in natural trigger terms and concrete capability detail. Its only gap is the absence of an explicit 'Use when...' trigger clause, which caps completeness at 2.

Suggestions

Add an explicit trigger clause, e.g. 'Use when testing session management, login/logout flows, or session tokens, or when the user asks to find session-fixation or ATO persistence bugs.'

Trim the parenthetical severity/methodology detail (e.g. 'Validate with TWO real sessions... body-diff every 200, and OOB confirmation') into the body, since it inflates the description without aiding trigger discovery.

DimensionReasoningScore

Specificity

Enumerates many concrete actions (fixation, invalidation on logout/password-change/email-change, predictable IDs, JWT exp/revocation, refresh-token rotation/reuse-detection, DBSC downgrade, cookie attributes) plus a concrete validation method (two sessions, body-diff, OOB), matching the 'lists multiple specific concrete actions' anchor.

3 / 3

Completeness

Clearly answers 'what' (enumerated vulnerability classes and validation method) but lacks an explicit 'Use when...' clause or equivalent trigger guidance, which per the judging guidelines caps completeness at 2.

2 / 3

Trigger Term Quality

Contains natural terms a user would say ('session', 'session ID', 'login', 'logout', 'JWT', 'cookie', 'OAuth/SSO', 'refresh token') with good coverage of common variations, even though some terms (DBSC, __Host-) are technical extras.

3 / 3

Distinctiveness Conflict Risk

Tightly scoped to session management with distinct triggers (session fixation, JWT-as-session, refresh-token rotation, DBSC), making it unlikely to trigger for the wrong skill.

3 / 3

Total

11

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.