credential-attack

Password spray methodology for bug bounty — when to do it vs web-vuln hunting, the wordlist-gen + breach-check + osint-employees + spray pipeline, mode selection (http-form / oauth / o365 / okta), rate-limit + lockout tactics, BBP legal guardrails, success detection, and the spray → authenticated /hunt chain pattern. Use when assessing whether credential attack is worth running on a target, picking the right mode, or recovering from common pitfalls.

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

92%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An actionable, well-sequenced operational skill with concrete commands, validation checkpoints, and clear feedback loops for its destructive operations. Its weakness is purely structural: everything lives in one large file with no progressive disclosure into referenced materials.

Suggestions

Split the TOOL LADDER & ALTERNATIVES and COMMON PITFALLS sections into separate reference files (e.g. tools.md, pitfalls.md) referenced one level deep from SKILL.md, so the main body stays a lean overview.

Verify the `tools/*.sh` / `tools/*.py` paths referenced in DEEP DIVE and HARD GUARDS actually exist as bundled scripts, or replace the `-h` invocations with the concrete usage inline.

Move version/time-sensitive specifics (e.g. 'Python 3.9', '2025' rule names) into a clearly labeled section so they don't age the core guidance.

Dimension	Reasoning	Score
Conciseness	The body is dense and operational with almost no padding of concepts Claude already knows — every section (pipeline, guards, pitfalls, checklist, tool ladder) contributes field-specific operational knowledge that earns its tokens.	3 / 3
Actionability	Provides copy-paste-ready concrete guidance throughout — exact flags (--delay 1800 --jitter 60, --max-count 1000000, --fail-regex "Invalid\|incorrect\|wrong"), code blocks, mode/filter tables, and specific commands like 'python ooxml/scripts/validate.py'-style invocations.	3 / 3
Workflow Clarity	The 4-stage pipeline is clearly sequenced with a diagram, and the OPERATIONAL CHECKLIST gives explicit before/during/after checkpoints with feedback loops (--dry-run pre-flight, stop-on-hit, abort-on-WAF-detection, notify-program-on-lockout) appropriate for the destructive live-auth operations involved.	3 / 3
Progressive Disclosure	The skill is a single monolithic ~385-line file with no bundle/reference files at all (references/, scripts/, assets/ are absent); the large TOOL LADDER, COMMON PITFALLS, and DEEP DIVE sections would benefit from being split into one-level-deep referenced files rather than kept inline.	2 / 3
	Total	11 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names concrete capabilities, uses natural trigger terms, and explicitly states both what it does and when to use it. Third-person voice is maintained throughout.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'wordlist-gen + breach-check + osint-employees + spray pipeline', 'mode selection (http-form / oauth / o365 / okta)', 'rate-limit + lockout tactics', 'success detection', 'the spray → authenticated /hunt chain pattern' — rather than vague language.	3 / 3
Completeness	Explicitly answers both what it does (the full methodology pipeline) and when to use it via a clear 'Use when assessing whether credential attack is worth running on a target, picking the right mode, or recovering from common pitfalls' clause.	3 / 3
Trigger Term Quality	Includes natural terms a user would actually say — 'password spray', 'credential attack', 'bug bounty', 'oauth / o365 / okta' — with good coverage of the domain's common vocabulary.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (credential attack as a parallel branch to /hunt in a bug-bounty pipeline) with distinct, specific triggers unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: shuvonsec/claude-bug-bounty
Path: skills/credential-attack/SKILL.md
Commit: 2009594

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.