CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-spa-api

Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon — SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of "Criticals" completely missed. Use whenever a target serves a JS-heavy SPA (React/Vue/Angular/Next), an "app"/"console"/"dashboard"/"portal" subdomain, or any `*api*` host shows up in recon. Leaked build artifacts (source maps / .env / .git / asset-manifest) are owned by hunt-source-leak; API version-inventory and behavioral diffing by hunt-shadow-api; this skill owns mapping a live SPA's backend routes from its JS bundle and testing them for broken access control / missing auth.

77

Quality

98%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

96%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, executable playbook with strong workflow sequencing and explicit safety/validation checkpoints. The only minor gap is progressive disclosure: all reference material is inlined since no bundle files exist, which is appropriate for the size but leaves no progressive split.

Suggestions

Consider extracting the secret-validation regex set and the response-interpretation matrix into a references/ file (e.g. RESPONSE_INTERPRETATION.md) to lighten the main body and add a one-level-deep pointer.

If a secret-validation cheat sheet grows, move it alongside hunt-source-leak's material to avoid future duplication.

DimensionReasoningScore

Conciseness

Lean, operational prose with copy-paste bash and no padding of concepts Claude already knows; explanatory sentences encode only non-obvious expertise (minifier string-segment routes, async chunk maps).

5 / 5

Actionability

Fully executable curl/grep commands across React/CRA, Next.js, and generic variants, plus a concrete response-class interpretation matrix covering 401/200/400/verbose-error cases.

5 / 5

Workflow Clarity

Five explicitly sequenced steps with a validation/differential checkpoint (step 3 establishes a gated control; step 4 compares every route against it) and a safety boundary in step 5 ('STOP at minimum-necessary proof').

5 / 5

Progressive Disclosure

Single well-organized file with clear section headers and clearly signaled one-level sibling-skill references; no bundle files exist to split into, though the inlined response-interpretation matrix and secret patterns are bulk content that a larger skill would externalize.

4 / 5

Total

19

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A high-quality description: concrete actions, comprehensive natural triggers, explicit what-and-when, and clear delineation from sibling skills. Third-person voice is maintained throughout.

DimensionReasoningScore

Specificity

States multiple concrete actions — 'Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication' — with comprehensive coverage of the play including route mapping and auth testing.

5 / 5

Completeness

Explicitly answers both 'what' (discover hidden API from the JS bundle and test for missing auth) and 'when' via the concrete 'Use whenever a target serves a JS-heavy SPA...' trigger clause.

5 / 5

Trigger Term Quality

Comprehensive natural triggers including 'JS-heavy SPA (React/Vue/Angular/Next)', 'app/console/dashboard/portal subdomain', and '*api* host shows up in recon', covering synonyms and concrete host-naming patterns users would actually say.

5 / 5

Distinctiveness Conflict Risk

Clear niche with explicit boundary disambiguation — 'Leaked build artifacts... owned by hunt-source-leak; API version-inventory and behavioral diffing by hunt-shadow-api; this skill owns mapping a live SPA's backend routes' — minimizing conflict risk.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.