hunt-business-logic

92 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By elementalsouls/Claude-BugHunter (GitHub) · security · 5,793 stars · scanned at commit 8ac4242

Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart price tampering (Upserve, Eternal/Zomato), decimal/fraction price-field overflow (Shipt), client-side checkout amount trust on PayPal redirect (WordPress.org), price-per-unit mass-assignment (Krisp), and archived-price swap / cart-TOCTOU (Stripe). Use when hunting business logic — heavy emphasis on financial-impact-demonstr…

Works with any agent that supports SKILL.md skills.

What this skill can do

Sends data to these websites: target.com, monitor.target.com

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 8 places.

skills/hunt-business-logic/SKILL.md, line 39- `fetch('/api/subscribe', { method: 'POST', body: ... })` with no anti-CSRF token or rate-limit token
skills/hunt-business-logic/SKILL.md, line 73curl -s -X POST https://target.com/api/subscribe \
skills/hunt-business-logic/SKILL.md, line 91curl -X POST https://target.com/payment/callback \

Show 5 more

skills/hunt-business-logic/SKILL.md, line 99curl -s https://target.com/robots.txt | grep -iE "(disallow|allow)"
skills/hunt-business-logic/SKILL.md, line 100curl -s https://target.com/sitemap.xml | grep -iE "(employee|internal|staff|summit|admin)"
skills/hunt-business-logic/SKILL.md, line 103curl -s https://target.com/assets/app.js | grep -oE '"/[a-zA-Z0-9/_-]{3,50}"' | sort -u
skills/hunt-business-logic/SKILL.md, line 110curl -s -X POST https://monitor.target.com/api/monitoring/enable \
skills/hunt-business-logic/SKILL.md, line 116curl -X POST https://target.com/verify \

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 5 places.

skills/hunt-business-logic/SKILL.md, line 72for i in $(seq 1 100); do
skills/hunt-business-logic/SKILL.md, line 91curl -X POST https://target.com/payment/callback \
skills/hunt-business-logic/SKILL.md, line 99curl -s https://target.com/robots.txt | grep -iE "(disallow|allow)"

Show 2 more

skills/hunt-business-logic/SKILL.md, line 110curl -s -X POST https://monitor.target.com/api/monitoring/enable \
skills/hunt-business-logic/SKILL.md, line 123grep -iE "(price|amount|total|cost)\s*[=*+]" app.js

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'hunt-business-logic' ] || [ -L ~/.agents/skills/'hunt-business-logic' ]; then echo 'A skill folder named hunt-business-logic already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet '8ac4242ee0a108e65ac1343b56cce6c50ba456ef' -- 'skills/hunt-business-logic' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/hunt-business-logic' ~/.agents/skills/'hunt-business-logic' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hunt-business-logic' ~/.claude/skills/'hunt-business-logic' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.

SkillTrust badge for elementalsouls/Claude-BugHunter

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/elementalsouls/Claude-BugHunter.svg)](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)

Score history

Date	Version	Score
2026-11-14	`8ac4242`	92
2026-11-10	`d5dcc53`	92
2026-11-08	`42a3ab1`	92
2026-11-06	`3e71af0`	92