CtrlK
BlogDocsLog inGet started
Tessl Logo

offensive-osint

Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog (AWS/GCP/GitHub/Stripe/Slack/Anthropic/OpenAI/Atlassian/DataDog/npm/PyPI), Postman workspaces, breach correlation (HudsonRock/HIBP/DeHashed/IntelX), TLS/JA3 audit, certificate transparency, JS endpoint extraction, package registry leaks, mobile/APK recon, sat imagery, sector-specific recon (healthcare DICOM, finance SWIFT, ICS/SCADA Modbus/BACnet). Detail content in 15 modular reference files, loaded on demand. Use for any authorized recon: scoping, asset discovery, attack-path mapping, secret triage, severity scoring.

68

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-architected operational index with excellent progressive disclosure and solid actionability, weakened mainly by a bloated, date-heavy changelog and an oversized self-test section that inflate token cost without proportional operational value.

Suggestions

Collapse the three-paragraph §50 changelog into a brief bullet summary or move full version history into a separate CHANGELOG.md reference file; keep only the current version note inline.

Trim the 40-prompt §49 self-test to ~10 representative prompts and move the rest into a reference file, since the full list is a verification aid rather than operational content.

Add a short explicit validation checkpoint in the "How to use this skill" workflow (e.g. confirm authorization per §1 before loading probes) to strengthen the feedback-loop aspect of workflow clarity.

DimensionReasoningScore

Conciseness

The operational core (§0-6, references index, §20-21, §39) is lean and assumes Claude's competence, but the body carries large time-sensitive blocks: a three-paragraph §50 changelog dense with 2026-04-27 dates/version numbers and a 40-prompt §49 self-test, both of which consume substantial tokens beyond what the rubric considers minor trimming.

3 / 5

Actionability

Provides concrete executable guidance inline — the §20 endpoint-interest rubric, §21 ownership score, and §39 attack-path templates give copy-paste-ready commands (e.g. "GET /pods", "etcdctl get / --prefix --keys-only") and references runnable scripts (secret_scan.py, h1_reference.py, dashboard.py), with the bulk of wordlists/regexes appropriately deferred to reference files.

4 / 5

Workflow Clarity

"How to use this skill" gives a clear 3-step sequence with loading rules of thumb mapped to trigger classes, plus confidence levels (§2) and output format (§3); the destructive/batch validation cap is largely avoided because §5 restricts destructive probes and validators are read-only, though explicit verify-checkpoints within workflows are only implicit.

4 / 5

Progressive Disclosure

Exemplary one-level-deep structure: a lean SKILL.md overview refactored from a 4168-line monolith, with 15 self-contained reference files (all confirmed present in references/) and a references-index table mapping file -> coverage -> trigger phrases for easy navigation.

5 / 5

Total

16

/

20

Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, comprehensive description that clearly states both capability and trigger conditions in third-person/imperative voice. Its main weakness is verbosity: dense parenthetical product lists stuff the prose and would be better served by the separate triggers block.

Suggestions

Move the parenthetical product enumerations (e.g. (AWS/GCP/GitHub/...), (Citrix/F5/Pulse/...), (HudsonRock/HIBP/DeHashed/IntelX)) out of the description prose and rely on the triggers list for those keywords.

Tighten the description to the top-level capability classes (subdomain enum, identity fabric, cloud bucket enum, secret-scan, breach correlation, TLS/cert audit, sector recon) without per-vendor detail.

DimensionReasoningScore

Specificity

Lists many concrete capabilities ("subdomain enum", "GraphQL/Swagger/REST discovery", "cloud bucket enum", "48-pattern secret-scan catalog", "TLS/JA3 audit") with comprehensive coverage, but the prose is padded with large parenthetical keyword blocks (e.g. "(AWS/GCP/GitHub/Stripe/Slack/Anthropic/OpenAI/Atlassian/DataDog/npm/PyPI)") that blur the core action list rather than clarifying it.

4 / 5

Completeness

Explicitly answers both what ("Operational arsenal for authorized external red-team and bug-bounty recon") and when ("Use for any authorized recon: scoping, asset discovery, attack-path mapping, secret triage, severity scoring"), satisfying the explicit-trigger-guidance requirement.

5 / 5

Trigger Term Quality

Comprehensive natural-term coverage including synonyms and product names users actually say ("bug bounty recon", "subdomain enumeration", "okta enum", "S3 enum", "have I been pwned", "crt.sh", "JA3 JA4"), matching the anchor for comprehensive keyword coverage.

5 / 5

Distinctiveness Conflict Risk

Carves a clear niche (authorized external offensive recon) with distinct triggers and minimal overlap risk with defensive or post-exploitation skills; the authorization framing further separates it.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.