credential-attack

Password spray methodology for bug bounty — when to do it vs web-vuln hunting, the wordlist-gen + breach-check + osint-employees + spray pipeline, mode selection (http-form / oauth / o365 / okta), rate-limit + lockout tactics, BBP legal guardrails, success detection, and the spray → authenticated /hunt chain pattern. Use when assessing whether credential attack is worth running on a target, picking the right mode, or recovering from common pitfalls.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced skill body with thorough validation checkpoints and concrete commands — its main weakness is progressive disclosure: heavy inline reference-style detail and no bundled reference files to offload it to.

Suggestions

Move the TOOL LADDER & ALTERNATIVES tables and COMMON PITFALLS into a bundled reference file (e.g. references/pitfalls-and-tools.md) and link to it from a short summary section, so the SKILL.md body stays a lean overview.

Add clearly signaled one-level-deep references (e.g. 'See references/spray-modes.md for mode details') instead of inlining every mode/tactic table in the main body.

Verify the referenced tools/*.sh and tools/*.py scripts actually exist in a scripts/ bundle, or mark them as external dependencies, so referenced paths are real files rather than dangling pointers.

Dimension	Reasoning	Score
Conciseness	Mostly lean, dense with non-obvious operational detail Claude would not already know (theHarvester cwd behavior, urllib opener SSL-context quirk, spray vs brute ordering); a few motivational/justification sentences (DBIR stat, 'Real-world initial-access vector') could be trimmed.	4 / 5
Actionability	Fully executable guidance with exact commands and flag values (/spray <login-url> --mode <mode>, --delay 1800 --jitter 60, --max-count 1000000, --filter strict), concrete file paths, decision shortcuts, and verified quantitative results covering the common modes.	5 / 5
Workflow Clarity	Clear 4-stage sequenced pipeline with an explicit before/during/after OPERATIONAL CHECKLIST, hard guards, a dry-run step, abort-on-detection and stop-on-first-hit feedback loops — the destructive/batch validation cap is satisfied, not triggered.	5 / 5
Progressive Disclosure	Good section structure (headers, tables, checklists) but it is a single monolithic SKILL.md with no bundle files present; large reference-style content (full tool-ladder tables, pitfalls, breach-count interpretation) is inlined and external tool references are not clearly signaled links to bundled material.	3 / 5
	Total	17 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both the capability (a 4-stage spray pipeline with modes, tactics, detection, and chaining) and concrete 'Use when' triggers. The only gap is slightly incomplete coverage of natural synonyms (brute force, credential stuffing, ATO).

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions and full coverage: the wordlist-gen + breach-check + osint-employees + spray pipeline, mode selection (http-form/oauth/o365/okta), rate-limit/lockout tactics, success detection, and the spray→authenticated /hunt chain — comprehensive rather than minor gaps.	5 / 5
Completeness	Explicitly answers both what (the spray pipeline, modes, tactics, legal guardrails, detection, chain) and when ('Use when assessing whether credential attack is worth running on a target, picking the right mode, or recovering from common pitfalls') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Strong natural trigger phrases ('assessing whether credential attack is worth running', 'picking the right mode', 'recovering from common pitfalls') plus 'password spray'/'bug bounty', but leans on internal command names and omits common synonyms like 'brute force', 'credential stuffing', or 'ATO'.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (credential/password-spray for bug bounty) explicitly distinguished from /hunt and /recon, with distinct triggers and minimal overlap with adjacent skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: shuvonsec/claude-bug-bounty
Path: skills/credential-attack/SKILL.md
Commit: 0826b13

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.