hunt-subdomain

Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issue (1-click OAuth ATO via wildcard `reply_to`, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel `cname.vercel-dns.com` deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover — emphasis on ATO-chain primitives (OAuth `redirect_uri`, cookie-domain, email DNS).

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable content with strong workflow sequencing and explicit validation gates, undercut mainly by verbose narrative impact scenarios and a monolithic structure that inlines material (citations, fingerprints, chains) which would benefit from separate reference files.

Suggestions

Move the 'Disclosed Report Citations' and provider fingerprint catalogue into a references/ file (e.g. FINGERPRINTS.md) and link one level deep from SKILL.md to improve progressive disclosure.

Tighten 'Real Impact Examples' to outcome + chain mapping, cutting narrative prose that restates why trusted domains bypass phishing filters—Claude already knows this.

Condense the 'Crown Jewel Targets' intro paragraph into a bullet-led list to remove explanatory padding.

Dimension	Reasoning	Score
Conciseness	Large portions are lean command blocks and fingerprints, but the narrative 'Real Impact Examples' scenarios and 'Crown Jewel Targets' intro explain impact concepts an expert Claude already knows and could be tightened.	3 / 5
Actionability	Provides fully executable, copy-paste-ready commands throughout—subfinder/amass/dnsx/subjack/nuclei/dig/curl/aws s3api—plus complete bash loops and grep fingerprint patterns covering the common provider cases.	5 / 5
Workflow Clarity	A 9-step sequenced methodology is paired with an explicit Gate 0 validation gate ('If you cannot show the provider resource is currently unclaimed and claimable, it is not a valid report') and a 5-chain operator checklist with feedback-style escalation guidance.	5 / 5
Progressive Disclosure	Well-organized with clear section headers, but the ~335-line body is monolithic: the disclosed-report citations, fingerprint catalogue, and chain compositions are inlined rather than split into reference files, and no bundle files exist to offload detail.	3 / 5
	Total	16 / 20 Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names the domain, multiple concrete provider techniques, and an explicit 'Use when' trigger in third-person voice. It is dense with attributed writeups, which aids specificity but slightly loads the trigger with jargon.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete provider-specific actions—Azure DevOps cloudapp regional-pool re-issue, Zendesk takeover→email interception→password reset, Vercel deleted-project takeover, Fastly CDN re-attach, S3 dangling-bucket cookie-scope—giving comprehensive coverage rather than vague claims.	5 / 5
Completeness	Explicitly answers both what (hunting skill for subdomain takeover with named provider fingerprints) and when ('Use when hunting subdomain takeover') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural phrases a hunter would say ('subdomain takeover', 'hunting', 'ATO-chain primitives', 'OAuth redirect_uri', 'cookie-domain', 'email DNS') with good coverage, but omits common synonyms like 'dangling CNAME' or 'dangling DNS'.	4 / 5
Distinctiveness Conflict Risk	Subdomain takeover is a clear, distinct niche, but the ATO-chain emphasis (OAuth redirect_uri, cookie-domain) creates minor overlap with sibling skills like hunt-oauth and hunt-auth-bypass.	4 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-subdomain/SKILL.md
Commit: 0ce18ba

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.