CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-shadow-api

Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy paths, header- and subdomain-based versioning), pull and diff every reachable OpenAPI/Swagger spec (including ones only findable via the Wayback Machine), and behaviorally diff old vs. current versions for auth/rate-limit/validation regressions rather than just response-shape differences. Distinct from hunt-api-misconfig, which owns exploitation once you have a spec or endpoint (mass assignment, JWT, OData, Swagger-chain attacks); distinct from hunt-subdomain, which owns host-level discovery. This skill owns the version-inventory and behavioral-diff workflow itself. Use when the target has versioned API paths, multiple specs, a changelog referencing deprecated endpoints, or a mobile app whose hardcoded backend calls look older than the current web app's.

79

Quality

100%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

100%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-crafted procedural hunting skill: executable code throughout, a clearly staged workflow with an explicit false-positive validation gate, a severity triage table, and actionable chaining guidance. It stays lean and self-contained without padding or over-explaining basics.

DimensionReasoningScore

Conciseness

The body is mostly executable bash/curl/jq blocks with tight bullets and does not explain basic concepts Claude already knows (e.g., what a Swagger spec or the Wayback Machine is); the two-sentence intro establishes the load-bearing 'delta' thesis, so nearly every token earns its place rather than the level-2 'could be tightened' case.

3 / 3

Actionability

Provides fully executable, copy-paste-ready shell — version-path/header/subdomain enumeration for-loops, curl behavioral-diff commands, and jq/comm spec path-diffing — rather than the pseudocode or incomplete guidance of level 2.

3 / 3

Workflow Clarity

Stages 1–4 are clearly sequenced and include an explicit 'False-Positive Gate' validation checkpoint ('Confirm the old endpoint is not simply an alias/proxy', 'confirm the underlying operation still executes') plus a Severity triage table, satisfying the anchor for clear sequence with explicit validation rather than the checkpoint gaps of level 2.

3 / 3

Progressive Disclosure

A single self-contained file with no external bundle, but well-organized into navigable sections (stages, false-positive gate, severity table, related skills) with no deep or nested reference chains; the inline content is cohesive workflow rather than reference bloat, so well-organized sectioning earns the level-3 anchor for this focused scope.

3 / 3

Total

12

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, information-dense description that covers concrete actions, natural trigger terms, explicit use-when guidance, and clear distinctiveness from sibling skills. Its only mild weakness is length, but it is packed with specifics rather than padded fluff.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'enumerate the full API version history (v1/v2/beta/legacy paths, header- and subdomain-based versioning)', 'pull and diff every reachable OpenAPI/Swagger spec', and 'behaviorally diff old vs. current versions for auth/rate-limit/validation regressions' — matching the anchor for listing several specific actions rather than the partial coverage of level 2.

3 / 3

Completeness

Explicitly answers both what (enumerate/diff versions and specs, behavioral diff) and when via an explicit 'Use when the target has versioned API paths, multiple specs, a changelog referencing deprecated endpoints, or a mobile app whose hardcoded backend calls look older...' clause, so it is not capped at 2.

3 / 3

Trigger Term Quality

Covers natural domain variations a user would say — 'shadow / zombie / undocumented API surface', 'deprecated endpoints', 'version history', 'OpenAPI/Swagger spec', 'Wayback Machine' — giving good keyword coverage rather than the sparse set of level 2.

3 / 3

Distinctiveness Conflict Risk

States clear sibling boundaries — 'Distinct from hunt-api-misconfig, which owns exploitation... distinct from hunt-subdomain, which owns host-level discovery. This skill owns the version-inventory and behavioral-diff workflow itself' — giving a clear niche unlikely to trigger the wrong skill.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.