hunt-session

Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token rotation/reuse-detection gaps, OAuth/SSO session linkage, device-bound-session (DBSC) downgrade, and cookie attribute issues (Secure/HttpOnly/SameSite/__Host-). Validate with TWO real sessions (attacker A + victim B), body-diff every 200, and OOB confirmation for theft chains. Medium to Critical (fixation→admin hijack, no-invalidation→persistent ATO).

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tight, highly actionable testing playbook with explicit, repeated validation discipline and clear phase sequencing; its only weakness is mild repetition of FP boilerplate across phases that could be consolidated.

Dimension	Reasoning	Score
Conciseness	Dense, operational content with minimal concept explanation (no 'what is a JWT' padding), but the body-diff / negative-control FP discipline is restated across several phases and the Chain Table partially echoes the description, so a few instances could be trimmed.	4 / 5
Actionability	Fully executable curl flows with real jar handling, a robust get_cookie extractor, base64url JWT decode, refresh-token rotation/replay tests, and entropy sampling — copy-paste ready with concrete decision criteria covering the common session-testing cases.	5 / 5
Workflow Clarity	Phases 1–8 are clearly sequenced with numbered steps, explicit decision rules, and repeated validation checkpoints (body-diff, negative control, cache/edge check, OOB), plus a final Validation checklist and severity gate — feedback loops for error recovery are present.	5 / 5
Progressive Disclosure	No bundle files exist and the skill is self-contained; sections are cleanly organized (Crown Jewel, Grounding, Attack Surface, Phases 1–8, Chain Table, Validation) with no nested references and easy navigation, which warrants a 5 per the simple-skill exception.	5 / 5
	Total	19 / 20 Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific and action-oriented with a clear niche, but it lacks an explicit 'Use when...' trigger clause, which caps its completeness and slightly weakens trigger-term quality.

Suggestions

Add an explicit 'Use when...' trigger clause, e.g. 'Use when testing session management, login/logout flows, session fixation, or token lifecycle on a web target.'

Soften or trim the closing severity aside ('Medium to Critical (fixation→admin hijack, no-invalidation→persistent ATO)') — impact framing belongs in the body, not the description.

Include one or two plain-language synonyms users might say (e.g. 'session hijacking', 'staying logged in after logout') alongside the technical terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete vulnerability classes (session fixation, no invalidation on logout/password/email change, low-entropy IDs, JWT no-exp, refresh-token reuse, DBSC downgrade, cookie attributes) plus concrete validation actions (TWO real sessions A+B, body-diff every 200, OOB confirmation) — comprehensive coverage of concrete actions.	5 / 5
Completeness	Clearly answers 'what' with detailed vulnerability classes and validation method, but provides no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 3 per the rubric.	3 / 5
Trigger Term Quality	Good keyword coverage (session, login, logout, password-change, JWT, refresh token, OAuth/SSO, cookie) but terms skew technical and lack common synonyms/extensions and explicit 'Use when' framing, so a few natural terms are missing.	4 / 5
Distinctiveness Conflict Risk	Clear, specific session-management niche with distinct triggers; minor overlap risk only with closely related sibling skills it cross-references (hunt-ato, hunt-oauth, hunt-csrf).	4 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-session/SKILL.md
Commit: 58017df

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.