CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-spa-api

Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon — SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of "Criticals" completely missed. Use whenever a target serves a JS-heavy SPA (React/Vue/Angular/Next), an "app"/"console"/"dashboard"/"portal" subdomain, or any `*api*` host shows up in recon. Leaked build artifacts (source maps / .env / .git / asset-manifest) are owned by hunt-source-leak; API version-inventory and behavioral diffing by hunt-shadow-api; this skill owns mapping a live SPA's backend routes from its JS bundle and testing them for broken access control / missing auth.

79

Quality

100%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

100%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, executable red-team playbook with copy-paste commands, an explicit control/validation step, and a response-interpretation table that makes the workflow reproducible. It respects the token budget and uses its data-minimization boundary to keep operations safe.

DimensionReasoningScore

Conciseness

Lean and almost entirely executable bash/grep with minimal concept-explanation; assumes Claude's competence and every prose line (control endpoint, interpretation table, anti-patterns) earns its place.

3 / 3

Actionability

Fully executable curl/grep commands with concrete regexes, a copy-paste route-testing loop, and a specific response-code interpretation table — copy-paste ready per the score-3 anchor.

3 / 3

Workflow Clarity

Clear 5-step sequence with an explicit validation checkpoint — step 3 establishes a CONTROL to capture correct rejection — plus interpretation feedback loops and a 'STOP at minimum-necessary proof' boundary.

3 / 3

Progressive Disclosure

No bundle files exist; the skill is a single self-contained, well-sectioned SKILL.md (~110 lines) with clear sections and only one-level sibling-skill name references, matching the simple-skill allowance for a score of 3.

3 / 3

Total

12

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense but information-rich description that explicitly states what it does, when to use it with natural trigger terms, and cleanly demarcates ownership against sibling skills. It stays in third person and avoids fluff despite its length.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'Discover a single-page-app's hidden backend API', 'mapping a live SPA's backend routes from its JS bundle', 'testing them for broken access control / missing auth' — matching the score-3 anchor of multiple specific concrete actions.

3 / 3

Completeness

Explicitly answers both what ('Discover... test that API for broken access control / missing authentication') and when ('Use whenever a target serves a JS-heavy SPA...'), satisfying the score-3 anchor with an explicit 'Use whenever' trigger clause.

3 / 3

Trigger Term Quality

Covers natural terms a user would say — 'JS-heavy SPA (React/Vue/Angular/Next)', 'app/console/dashboard/portal subdomain', '*api* host in recon' — with good coverage of common variations.

3 / 3

Distinctiveness Conflict Risk

Clear niche with explicit ownership demarcation — 'Leaked build artifacts... owned by hunt-source-leak; API version-inventory and behavioral diffing by hunt-shadow-api; this skill owns mapping a live SPA's backend routes' — unlikely to trigger the wrong skill.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.