hunt-tls-network

Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records. Most of these are Info/Low on their own — this skill is opinionated about which findings actually pay (spoofable DMARC with delivered-to-inbox proof, AXFR returning internal hosts, dangling-CNAME takeover) versus which get rejected as best-practice noise (missing CAA, missing HSTS with no MitM position). Use during recon to find infrastructure weaknesses, and to TRIAGE them honestly before reporting.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A high-quality, opinionated recon-and-triage skill body: executable commands, strong validation gates, and honest severity calibration. Its main weakness is conciseness — severity guidance is restated in two places and several CVE explanations are educational rather than action-bearing — and a long monolithic file that could offload reference material to bundle files.

Suggestions

Collapse the duplicate severity guidance: keep the Chain Table as the single source of truth and have the Validation section reference it instead of restating severities.

Move the per-CVE reference detail (SWEET32/POODLE/FREAK/DROWN mechanics) into a references/ file (e.g. TLS_CVE_NOTES.md) and link to it from Phase 1, trimming the inline body.

Tighten the Phase 1 accuracy notes to action-bearing bullets (what to run + what result means) and drop the historical attack-mechanic prose Claude already knows.

Dimension	Reasoning	Score
Conciseness	Mostly efficient but padded in places — CVE mechanics for SWEET32/POODLE/FREAK/DROWN are educational, and severity guidance is duplicated across the Chain Table and the Validation 'Severity' block; matches the 'mostly efficient but includes some unnecessary explanation or could be tightened' anchor; not 4 because the duplication and CVE walkthroughs are noticeable rather than minor.	3 / 5
Actionability	Copy-paste-ready executable bash throughout (testssl, openssl, dig, swaks, curl) covering the common cases, with the only placeholders being justified necessities; matches the 'fully executable; copy-paste ready' anchor; not 4 because there are no real execution gaps.	5 / 5
Workflow Clarity	Eight clearly sequenced phases with explicit validation/confirmation gates ('Validation gate', 'Confirmation gate', 'Pre-submission scope gate') and feedback loops (e.g. tear-down after PoC, 'if SSLv3 won't negotiate, there is no POODLE'); matches the top anchor with explicit validation steps and error-recovery guidance; not 4 because checkpoints are explicit, not implicit.	5 / 5
Progressive Disclosure	Well-organized into a clear overview (Reality Check) and navigable phase headers, with the one cross-skill reference (hunt-subdomain) clearly signaled; no bundle files exist so all content is inline, and at ~350 lines some material (CVE reference details, Chain Table) could be split out — matches 'good structure; most content appropriately placed; minor organization gaps'; not 5 because there is no one-level-deep reference split, not 3 because structure and navigation are solid.	4 / 5
	Total	17 / 20 Passed

Description

96%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, opinionated description that clearly states what the skill does and when to use it, with rich natural trigger terms. The only weakness is mild verbosity (the editorializing 'which findings actually pay vs. rejected as best-practice noise' sentence is body-framing more than capability) and minor overlap with the hunt-subdomain skill on dangling-CNAME takeover.

Dimension	Reasoning	Score
Specificity	Lists many concrete actions (HSTS, weak ciphers, cert validity, mTLS bypass, SPF/DKIM/DMARC, AXFR, dangling-CNAME takeover, CAA), matching the 'multiple specific concrete actions; comprehensive coverage' anchor; it is not 4 because coverage is broad rather than having only minor gaps.	5 / 5
Completeness	Explicitly answers both — 'what' (hunt/triage TLS & DNS misconfigurations, enumerated) and 'when' ('Use during recon to find infrastructure weaknesses, and to TRIAGE them honestly before reporting'), matching the top anchor; not 4 because the 'when' is concrete and specific, not merely present.	5 / 5
Trigger Term Quality	Dense with natural security-audience keywords and synonyms (TLS/SSL, DNS, HSTS, cipher suites, mTLS, SPF/DKIM/DMARC, AXFR, CNAME, CAA, recon), matching the 'comprehensive coverage of natural terms including synonyms' anchor; not 4 because no common variation is obviously missing.	5 / 5
Distinctiveness Conflict Risk	Clear niche (TLS/DNS recon + opinionated triage) with distinctive triggers, but 'dangling CNAME subdomain takeover' overlaps with the sibling hunt-subdomain skill, creating minor overlap risk — the 'mostly distinct; minor overlap risk with closely related skills' anchor; not 5 because of that overlap, not 3 because the triage framing keeps it largely distinguishable.	4 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-tls-network/SKILL.md
Commit: a590333

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.