hunt-tls-network

Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records. Most of these are Info/Low on their own — this skill is opinionated about which findings actually pay (spoofable DMARC with delivered-to-inbox proof, AXFR returning internal hosts, dangling-CNAME takeover) versus which get rejected as best-practice noise (missing CAA, missing HSTS with no MitM position). Use during recon to find infrastructure weaknesses, and to TRIAGE them honestly before reporting.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A high-quality, highly actionable recon/triage skill with executable commands and strong validation gates throughout. The main weakness is redundancy: severity guidance and do-not-file lists recur across the Reality Check, Chain Table, and Validation sections.

Suggestions

Consolidate severity calibration into the single Chain Table and have the Reality Check and Validation sections reference it instead of restating severities — this removes a sizable fraction of the body length.

Move the per-vulnerability caveats (SWEET32/POODLE/FREAK/DROWN/Heartbleed) into a references/ file (e.g. TLS_CAVEATS.md) linked from Phase 1, keeping that phase to the runnable commands plus the offered-vs-exploitable rule.

The 'What does NOT pay (do not report standalone)' list in Reality Check duplicates the Info-tier 'do not file' rows in the Chain Table — keep one and point to the other rather than maintaining both.

Dimension	Reasoning	Score
Conciseness	Information-dense and largely avoids basic-concept padding, but the severity calibration is restated three times (Reality Check 'What actually pays' / 'What does NOT pay' lists, the Chain Table, and the Validation severity list), and the 'do not file' rows overlap across them — the skill could be tightened by consolidating these.	3 / 5
Actionability	Copious copy-paste-ready, executable commands cover the common cases: testssl/sslyze/openssl s_client for TLS, dig AXFR loops, a full swaks spoof-PoC, and concrete mTLS header-injection bypass loops with real header names and -w '%{http_code}' checks.	5 / 5
Workflow Clarity	Eight sequenced phases each carry explicit validation/confirmation gates — the takeover 'register + canary + tear-down' gate, the DMARC 'Inbox not Spam + Authentication-Results' confirmation gate, and the mTLS 'prove privileged access, not just a 200' gate — with feedback loops ('if SSLv3 won't negotiate, there is no POODLE'; tear down after PoC).	5 / 5
Progressive Disclosure	Well-organized into clearly headed phases plus Chain Table and Validation sections, with the one cross-skill reference ('Full depth lives in hunt-subdomain') signaled one level deep; no bundle files exist, and while the per-vuln caveats or Chain Table could optionally move to a references/ file, inlining is defensible for a triage-oriented skill.	4 / 5
	Total	17 / 20 Passed

Description

96%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, opinionated description that names a comprehensive concrete finding set, packs in natural recon trigger terms, and explicitly covers both what and when. Only minor overlap with the sibling hunt-subdomain skill keeps distinctiveness just off the top anchor.

Dimension	Reasoning	Score
Specificity	Enumerates a comprehensive set of concrete misconfigurations — 'missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records' — paired with concrete triage verbs ('Hunt', 'TRIAGE'); coverage of the domain is comprehensive rather than 1-2 actions.	5 / 5
Completeness	Explicitly answers both what ('Hunt TLS/SSL and DNS misconfigurations' plus an opinionated pay-vs-noise list) and when ('Use during recon to find infrastructure weaknesses, and to TRIAGE them honestly before reporting'), satisfying the 'Use when...' trigger requirement.	5 / 5
Trigger Term Quality	Dense with natural recon terms a security tester would actually say: 'TLS/SSL', 'HSTS', 'cipher suites', 'mTLS', 'SPF/DKIM/DMARC', 'email spoofing', 'AXFR' / 'zone transfer', 'subdomain takeover', 'CNAME', 'CAA', 'recon' — including synonyms (TLS/SSL, AXFR/zone transfer).	5 / 5
Distinctiveness Conflict Risk	Carves a distinct TLS/DNS-recon-plus-triage niche and explicitly hands takeover depth off to 'hunt-subdomain', but stays in the same hunt-* family with minor overlap risk on the dangling-CNAME angle, fitting 'mostly distinct; minor overlap risk with closely related skills' better than the top anchor.	4 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-tls-network/SKILL.md
Commit: 0ce18ba

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.