CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-sqli

Hunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM CVE-2024-53900 $where bypass), modern ORM raw-fragment SQLi (Django CVE-2024-42005, Sequelize GHSA-wrh9-cjv3-2hpw), second-order SOQL injection (HackerOne Salesforce), time-based blind SQLi in GraphQL resolvers, and SQLi on OIDC-proxy backends. Use when hunting SQLi on any target. Dedicated NoSQL operator injection (MongoDB/CouchDB $where/$regex/$ne) is owned by hunt-nosqli — NoSQL appears here only as adjacent ORM/WAF context.

69

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

70%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is exceptionally actionable with a clear, gated hunting workflow, but it is a monolithic wall of text with no progressive disclosure and notable redundancy across sections. Strengths are actionability and workflow clarity; the weaknesses are progressive disclosure (none) and conciseness (repetition and soft padding).

Suggestions

Split the large inline blocks into reference files (e.g. references/payloads.md for the payload/detection patterns, references/cve-citations.md for the disclosed-report citations) and link to them with 'See X.md' from a leaner SKILL.md overview, addressing progressive_disclosure.

De-duplicate the UNION column-enumeration guidance, which appears in 'Autonomous Testing Priority', step 9 of the methodology, and the Payload & Detection Patterns section — keep one authoritative version and cross-reference it to improve conciseness.

Remove soft framing prose Claude already knows (e.g. 'SQL injection remains one of the highest-paying vulnerability classes in bug bounty because it directly threatens data confidentiality, integrity, and availability at scale') to tighten token efficiency.

DimensionReasoningScore

Conciseness

Mostly efficient and actionable, but ~420 lines re-explain the same UNION column-enumeration technique across three sections ('Autonomous Testing Priority', step 9 of the methodology, and the Payload section) and include soft padding Claude already knows ('SQL injection remains one of the highest-paying vulnerability classes... because it directly threatens data confidentiality, integrity, and availability at scale'). Could be tightened without losing clarity; not level-1 concept-padding but not lean either.

2 / 3

Actionability

Highly executable: concrete SQL/curl/sqlmap commands, grep patterns, Burp Intruder payload lists, and exact CVE payloads such as '{"token":{"$regex":"^a"}}' and 'Model.find().populate({path:'author', match:{$where:"sleep(5000) || true"}})'. Copy-paste ready and specific, matching the level-3 anchor.

3 / 3

Workflow Clarity

Clear sequenced methodology (10-step hunting process) with an explicit validation checkpoint — the 'Gate 0 Validation' gate (attacker ability, victim loss, 10-minute reproducibility) and proof requirement ('Proof = the extracted data... appears in the response'). Feedback loops and error-recovery guidance are present.

3 / 3

Progressive Disclosure

No bundle files exist (references/scripts/assets absent) and the body is a single ~22KB monolithic wall of text with payload lists, CVE citations, scenario examples, and attack-surface signals all inline; there is no 'See X.md' navigation or content split. Matches the monolithic-wall level-1 anchor.

1 / 3

Total

9

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, complete (both what and an explicit Use-when clause), and actively de-conflicts with the sibling hunt-nosqli skill. Voice is third person throughout, incurring no penalty. It is a strong, level-3 description across all dimensions.

DimensionReasoningScore

Specificity

Lists multiple concrete, named capabilities and real CVE examples — 'modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex...)', 'ORM raw-fragment SQLi (Django CVE-2024-42005)', 'time-based blind SQLi in GraphQL resolvers'. Matches the anchor for listing multiple specific concrete actions.

3 / 3

Completeness

Explicitly answers both what it does (hunting skill for sqli vulnerabilities, enumerating subtypes) and when to use it via the explicit 'Use when hunting SQLi on any target.' trigger clause, matching the level-3 anchor.

3 / 3

Trigger Term Quality

Uses natural terms a user would actually say — 'sqli vulnerabilities', 'SQLi', 'NoSQL injection', 'blind SQLi', 'Use when hunting SQLi on any target'. Good coverage of common variations; not jargon-only.

3 / 3

Distinctiveness Conflict Risk

Has explicit de-confliction: 'Dedicated NoSQL operator injection... is owned by hunt-nosqli — NoSQL appears here only as adjacent ORM/WAF context.' Clear niche with distinct triggers unlikely to fire for the wrong skill.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.