CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-shadow-api

Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy paths, header- and subdomain-based versioning), pull and diff every reachable OpenAPI/Swagger spec (including ones only findable via the Wayback Machine), and behaviorally diff old vs. current versions for auth/rate-limit/validation regressions rather than just response-shape differences. Distinct from hunt-api-misconfig, which owns exploitation once you have a spec or endpoint (mass assignment, JWT, OData, Swagger-chain attacks); distinct from hunt-subdomain, which owns host-level discovery. This skill owns the version-inventory and behavioral-diff workflow itself. Use when the target has versioned API paths, multiple specs, a changelog referencing deprecated endpoints, or a mobile app whose hardcoded backend calls look older than the current web app's.

73

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, highly actionable body anchored in executable commands and a clear staged workflow with a false-positive gate. The main improvement room is tightening the conceptual intro and, optionally, splitting dense wordlists/examples into reference files.

Suggestions

Trim or remove the opening 'As an API evolves...' paragraph — its delta-focused insight is already implicit in the staged workflow and the false-positive gate.

Consider extracting the version/subdomain wordlists (Stage 1) and the spec-path list (Stage 2) into a reference file so the SKILL.md body stays a lean overview.

Add an explicit per-stage 'verify before proceeding' checkpoint (e.g., confirm reachability before carrying a version forward) to turn the end-of-workflow gate into inline feedback loops.

DimensionReasoningScore

Conciseness

Mostly efficient — the body is dominated by executable commands and tight bullets — but the opening paragraph ('As an API evolves...') restates conceptual framing Claude largely already knows and could be trimmed.

4 / 5

Actionability

Fully executable, copy-paste-ready curl/jq/comm snippets cover the common cases: path/header/subdomain version enumeration, spec discovery, Wayback lookup, endpoint-set diffing, and per-regression behavioral tests.

5 / 5

Workflow Clarity

Stages 1–4 are clearly sequenced with an explicit False-Positive Gate acting as a verification checklist, but it lacks the tight validate→fix→retry→proceed feedback loops of a top score; the batch-operation cap does not bind because validation is present rather than missing.

4 / 5

Progressive Disclosure

Well-organized into clearly headed sections with no nested or buried references and content appropriately placed inline, but at ~153 lines with no external reference split it does not meet the under-50-line simple-skill exception for a 5.

4 / 5

Total

17

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An excellent description: concrete actions, comprehensive natural trigger terms, explicit what-and-when guidance, and clear delineation from neighboring skills. No meaningful gaps to penalize.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — enumerate version history (path/header/subdomain), pull and diff every reachable spec, and behaviorally diff auth/rate-limit/validation regressions — with comprehensive coverage of the workflow.

5 / 5

Completeness

Explicitly states both what the skill does (version-inventory and behavioral-diff workflow) and when to use it via a concrete 'Use when...' clause with multiple trigger conditions.

5 / 5

Trigger Term Quality

Covers natural synonyms ('shadow / zombie / undocumented API') plus concrete triggers ('versioned API paths', 'OpenAPI/Swagger spec', 'changelog referencing deprecated endpoints', 'mobile app whose hardcoded backend calls').

5 / 5

Distinctiveness Conflict Risk

Explicitly carves its niche from hunt-api-misconfig (exploitation) and hunt-subdomain (host discovery), giving it a clear distinct trigger surface with minimal conflict risk.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.