hunt-ssrf

Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One 106M-record breach, Dropbox/HelloSign $4,913), GCP metadata SSRF (Snapchat $4k), Azure IMDS SSRF (Azure DevOps $15k chain, ChatGPT Custom Actions MSRC), DNS rebinding SSRF (Concrete CMS, GitLab UrlBlocker), gopher-protocol-to-Redis-RCE (Yahoo Mail $15k), link-preview SSRF (Reddit Matrix $6k), and headless-browser PDF-generator SSRF chains. Use when hunting SSRF on any target — OOB Collaborator confirmation mandatory for blind cases.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-ssrf/SKILL.md

Quality

Content

66%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable payloads and excellent validation-gated workflows, but it is verbose and monolithic: ~490 lines with no reference files, inlining report writeups and catalogs that should be split out for progressive disclosure.

Suggestions

Move the 'Real Impact Examples' and 'Disclosed Report Citations' sections into a references/ file (e.g. reports.md) and keep only a one-line pointer in SKILL.md to cut hundreds of lines.

Extract the Bypass Techniques and Payload & Detection Patterns blocks into a payloads.md reference, leaving a concise core hunting workflow in the body.

Tighten prose sections (root-cause narratives, engagement lessons) to assume expert knowledge and trim redundant explanation.

Dimension	Reasoning	Score
Conciseness	At ~490 lines the body is noticeably verbose: long prose scenarios (Real Impact Examples), multi-paragraph lessons, and explanatory root-cause narratives restate context an expert SSRF hunter already knows and could be trimmed or moved to references.	2 / 5
Actionability	Copy-paste-ready payloads and commands throughout — interactsh-client invocations, cloud metadata URLs, an executable Python redirect server, JavaScript exfil snippets, and ffuf/grep one-liners — cover the common cases completely.	5 / 5
Workflow Clarity	Sequenced 10-step methodology plus an 'OOB-Or-It-Didn't-Happen' gate and 'Gate 0 Validation' with explicit validate→fix→retry feedback loops and a negative-control requirement, exactly the checkpoint structure the rubric rewards.	5 / 5
Progressive Disclosure	No bundle files exist and the body is a single monolithic document inlining what clearly belongs in separate references (full report citations, bypass tables, payload catalogs), with only inline cross-skill mentions rather than one-level-deep file navigation.	2 / 5
	Total	14 / 20 Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly names the skill's niche and concrete capabilities with an explicit 'Use when' trigger. It could score higher on trigger-term quality and completeness by adding a few more natural user-facing phrases and separating the 'when' conditions more explicitly.

Suggestions

Add a couple of plain-language trigger synonyms a user might say (e.g. 'server-side request forgery', 'internal endpoint access', 'metadata endpoint testing') alongside the technical terms.

Split the 'Use when...' clause into a short enumerated list of trigger scenarios so the 'when' is as explicit as the 'what'.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capabilities — AWS/GCP/Azure metadata SSRF, DNS rebinding, gopher-to-Redis-RCE, link-preview SSRF, headless-browser PDF chains — across 15 named reports with payouts, giving comprehensive coverage of the skill's actions.	5 / 5
Completeness	It clearly states what the skill does ('Hunting skill for ssrf vulnerabilities... Built from 15 public bug bounty reports') and gives an explicit 'Use when hunting SSRF on any target' clause, but the 'when' is slightly compressed and bundles conditions into one sentence rather than enumerating concrete trigger scenarios.	4 / 5
Trigger Term Quality	Natural trigger phrases like 'Use when hunting SSRF', 'OOB Collaborator confirmation', and 'cloud metadata' are present, but it leans on jargon-heavy terms (IMDSv1, gopher-protocol) rather than the fuller set of synonyms a user might naturally say.	4 / 5
Distinctiveness Conflict Risk	The SSRF niche is sharply defined with distinct triggers (metadata services, DNS rebinding, gopher-protocol, link previews) and cross-references to sibling skills (cloud-iam-deep, hunt-rce), giving minimal conflict risk with unrelated skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-ssrf/SKILL.md
Commit: 0ce18ba

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.