security-arsenal

Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, or bypass techniques. Submittability and the always-rejected / what-NOT-to-submit decision are owned by triage-validation.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, lean payload arsenal with strong embedded validation philosophy and sequenced procedures for the risky operations it covers. Its main weakness is progressive disclosure: the entire catalog lives in one monolithic file with no bundle references, where a per-vuln-class file split would let SKILL.md serve as a navigable overview.

Suggestions

Split the large per-vuln-class payload sections into separate reference files (e.g. references/xss.md, references/ssrf.md, references/sqli.md) and reduce SKILL.md to an overview that links one level deep into them, lifting progressive_disclosure above 3.

Move the 'Conditionally Valid — Requires Chain' and 'Always Rejected' tables, plus the Operator Notes, into references/triage-and-freshness.md if they grow, keeping SKILL.md focused on payload lookup navigation.

Trim a few of the more verbose inline comments inside payload code blocks (e.g. the SSTI 'Where to Test' list and some WAF-bypass commentary) to push conciseness from 4 toward 5.

Dimension	Reasoning	Score
Conciseness	The body is dense reference data with minimal prose padding and no re-explanation of concepts Claude already knows; the Operator Notes add genuine 2026-specific value framed as a staleness/deprecation section so version info is not penalized. It stops short of a clean 5 only because the overall volume is large and a few inline explanatory comments could be trimmed.	4 / 5
Actionability	Fully executable, copy-paste-ready payloads and real commands (ffuf, hashcat, curl, wscat, base64) across every common vuln class, with concrete exploit code for SSTI/JWT/SAML/MFA — matching the anchor-5 'specific examples cover the common cases'.	5 / 5
Workflow Clarity	Strong sequenced procedures (MFA Patterns 1–7, HTTP smuggling detection, WAF eval order 1–4) and explicit validation gates (OOB-Or-It-Didn't-Happen, marker discipline, Welch's t / n≥10 sampling, 'build chain → confirm end-to-end → THEN report') mean the destructive/batch cap at 3 does not bind. It is not a top-to-bottom sequenced workflow doc, so it does not reach 5.	4 / 5
Progressive Disclosure	No bundle files exist, so ~850 lines of per-class payload tables are all inlined in SKILL.md when they could be split into reference files (e.g. references/xss.md) with SKILL.md as an overview. Section headers are well-organized and cross-skill references (hunt-xss, triage-validation) are clearly signaled one level deep, which keeps it at 3 rather than lower.	3 / 5
	Total	16 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that crisply states what the skill provides and when to use it, with comprehensive trigger-term coverage and an explicit boundary to avoid skill overlap. The only ding is the second-person 'you need' phrasing, which the rubric penalizes on specificity.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete contents (payloads, bypass tables, wordlists, gf pattern names, always-rejected list, conditionally-valid-with-chain table) with comprehensive vuln-class coverage, matching the anchor-5 example; reduced by 1 per the second-person penalty because the description uses 'Use when you need' (explicit 'you') instead of third-person voice.	4 / 5
Completeness	Explicitly answers both 'what' (the resource inventory) and 'when' ('Use when you need specific payloads for...') with concrete trigger phrases, and adds a delegation boundary to triage-validation.	5 / 5
Trigger Term Quality	Enumerates the full set of natural trigger terms a pentester actually says ('XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass') plus synonyms ('bypass techniques', 'bypass tables'), giving comprehensive coverage.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche as a payload/bypass lookup library with distinct vuln-class triggers, and explicitly delegates submittability decisions to triage-validation, minimizing overlap with sibling skills.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (912 lines); consider splitting into references/ and linking	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/security-arsenal/SKILL.md
Commit: 0ce18ba

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.