hunt-ato

92 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (forge token to another identity; crypto details → hunt-jwt-crypto), (7) password change without step-up (chain with login timing/length oracle), (8) soc…

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 7 places.

skills/hunt-ato/SKILL.md, line 13POST /forgot-password HTTP/1.1
skills/hunt-ato/SKILL.md, line 38ffuf -u "https://target.com/api/reset/verify" -X POST \
skills/hunt-ato/SKILL.md, line 56PUT /api/user/email HTTP/1.1

Show 4 more

skills/hunt-ato/SKILL.md, line 65python3 -c "import jwt; print(jwt.encode({'sub':'victimB','role':'admin'}, key='', algorithm='none'))"
skills/hunt-ato/SKILL.md, line 82POST /api/account/password
skills/hunt-ato/SKILL.md, line 97ffuf -u "https://target.com/account/recover/answer" -X POST \
skills/hunt-ato/SKILL.md, line 109GET /oauth/authorize?client_id=...&redirect_uri=https://anything.target.com/cb&response_type=code

Sends data to these websites: target.com

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 2 places.

skills/hunt-ato/SKILL.md, line 69curl -s https://target.com/.well-known/jwks.json # or /oauth/.well-known/... grab the RSA pub key
skills/hunt-ato/SKILL.md, line 88t=$(curl -s -o /dev/null -w '%{time_total}' -d "user=victimB&pass=$p" https://target.com/login)

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'hunt-ato' ] || [ -L ~/.agents/skills/'hunt-ato' ]; then echo 'A skill folder named hunt-ato already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/hunt-ato' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/hunt-ato' ~/.agents/skills/'hunt-ato' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hunt-ato' ~/.claude/skills/'hunt-ato' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.

SkillTrust badge for elementalsouls/Claude-BugHunter

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/elementalsouls/Claude-BugHunter.svg)](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)

Score history

Date	Version	Score
2026-11-10	`d5dcc53`	92
2026-11-08	`42a3ab1`	92
2026-11-06	`3e71af0`	92