hunt-sqli

Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM CVE-2024-53900 $where bypass), modern ORM raw-fragment SQLi (Django CVE-2024-42005, Sequelize GHSA-wrh9-cjv3-2hpw), second-order SOQL injection (HackerOne Salesforce), time-based blind SQLi in GraphQL resolvers, and SQLi on OIDC-proxy backends. Use when hunting SQLi on any target. Dedicated NoSQL operator injection (MongoDB/CouchDB $where/$regex/$ne) is owned by hunt-nosqli — NoSQL appears here only as adjacent ORM/WAF context.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-sqli/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An information-dense, highly actionable SQLi hunting skill with comprehensive payloads and a solid validation gate, but it is a long monolithic document with no progressive file-splitting and carries some explanatory prose about concepts Claude already knows.

Suggestions

Move the payload catalogs (Payload & Detection Patterns, Bypass Techniques) and the Disclosed Report Citations into reference files under references/ and link to them one level deep, reducing the inline SKILL.md footprint and improving progressive_disclosure.

Trim narrative rationale Claude already knows — e.g., the "SQL injection remains one of the highest-paying..." opener and the multi-paragraph Real Impact Examples — to leaner pointers, improving conciseness.

Add explicit per-step validation checkpoints inside the 10-step methodology (not just the final Gate 0) so each transition is gated, lifting workflow_clarity from 4 to 5.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with dense, actionable payload/command blocks, but includes noticeable explanatory prose Claude already knows — e.g., "SQL injection remains one of the highest-paying vulnerability classes in bug bounty because...", the multi-paragraph "Real Impact Examples" narratives, and "Common Root Causes" rationale that could be tightened.	3 / 5
Actionability	Highly executable throughout: copy-paste error/boolean/time/UNION/NoSQL payloads, curl timing one-liners, sqlmap invocations, grep patterns for JS source hunting, and a Burp Intruder column-enumeration list, with specific real CVE payloads (Rocket.Chat DDP, Mongoose populate match, Django values).	5 / 5
Workflow Clarity	A clearly sequenced 10-step methodology plus a decision workflow (UNION vs blind) and a strong final "Gate 0 Validation" checklist with explicit reproducibility criteria; the UNION procedure has feedback loops (increment ORDER BY until error, do not select columns until NULL count matches), though per-step validation gates between methodology steps are not all explicit.	4 / 5
Progressive Disclosure	Well-organized with clear section headers, but the skill is a single monolithic file with no bundle files and no one-level-deep references; large reference-style blocks (payload catalogs, bypass techniques, disclosed report citations) that could live in separate files are all inlined.	3 / 5
	Total	15 / 20 Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, concrete description that names multiple SQLi subtypes, includes an explicit "Use when" trigger, and proactively de-conflicts with the sibling hunt-nosqli skill. It is slightly capped by jargon-heavy phrasing, the single generic "Hunting" verb, and a broad "on any target" trigger.

Dimension	Reasoning	Score
Specificity	Names the SQLi domain and enumerates several concrete capability subtypes ("modern NoSQL injection", "ORM raw-fragment SQLi", "second-order SOQL injection", "time-based blind SQLi in GraphQL resolvers", "SQLi on OIDC-proxy backends"), but the action verb itself is the single generic "Hunting" rather than multiple distinct verbs, leaving minor coverage gaps versus a fully comprehensive action list.	4 / 5
Completeness	Clearly answers "what" (a SQLi hunting skill built from 12 reports across named subtypes) and "when" ("Use when hunting SQLi on any target"), but the "when" trigger is somewhat generic ("on any target") rather than tying to concrete situational cues.	4 / 5
Trigger Term Quality	Includes natural user-facing terms ("sqli", "SQLi", "hunting SQLi") and an explicit trigger clause, but leans on jargon (CVE numbers, "OIDC-proxy", "GraphQL resolvers") and omits common synonyms like the fully spelled-out "SQL injection".	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (SQLi hunting) and explicitly de-conflicts with an adjacent skill ("Dedicated NoSQL operator injection ... is owned by hunt-nosqli — NoSQL appears here only as adjacent ORM/WAF context"), minimizing wrong-skill triggering.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-sqli/SKILL.md
Commit: 0ce18ba

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.