← All skills
hunt-laravel
90 / 100 · Low risk
Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By elementalsouls/Claude-BugHunter (GitHub) · security · 5,793 stars · scanned at commit 8ac4242
Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard unauthorized access, Ignition RCE (CVE-2021-3129), Signed URL manipulation, Queue Worker abuse, mass assignment via Eloquent, deserialization via cookies, .env file exposure. Use when target runs Laravel (PHP) — detected via X-Powered-By, Laravel session cookies, or /storage/ paths.
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: $target, $target$path
The author does not mention this. Expected for a security skill.
Found in 29 places.
Show 17 more
- skills/hunt-laravel/SKILL.md, line 37
curl -s "https://$TARGET/definitely-does-not-exist-xyz" | grep -i "laravel\|Whoops\|Ignition\|symfony" - skills/hunt-laravel/SKILL.md, line 46
curl -s "https://$TARGET/nonexistent" | grep -i "Whoops\|APP_DEBUG\|Ignition" - skills/hunt-laravel/SKILL.md, line 51
curl -s "https://$TARGET/_ignition/health-check" | head -5 - skills/hunt-laravel/SKILL.md, line 60
curl -s -X POST "https://$TARGET/_ignition/execute-solution" \ - skills/hunt-laravel/SKILL.md, line 77
curl -s "https://$TARGET/telescope" | grep -i "telescope\|laravel" - skills/hunt-laravel/SKILL.md, line 78
curl -s "https://$TARGET/telescope/api/requests" | python3 -m json.tool 2>/dev/null | head -50 - skills/hunt-laravel/SKILL.md, line 79
curl -s "https://$TARGET/telescope/api/commands" | python3 -m json.tool 2>/dev/null | head -30 - skills/hunt-laravel/SKILL.md, line 80
curl -s "https://$TARGET/telescope/api/redis" | python3 -m json.tool 2>/dev/null | head -30 - skills/hunt-laravel/SKILL.md, line 81
curl -s "https://$TARGET/telescope/api/environment" | python3 -m json.tool 2>/dev/null | head -50 - skills/hunt-laravel/SKILL.md, line 84
curl -s "https://$TARGET/horizon" | grep -i "horizon\|laravel" - skills/hunt-laravel/SKILL.md, line 85
curl -s "https://$TARGET/horizon/api/stats" | python3 -m json.tool 2>/dev/null - skills/hunt-laravel/SKILL.md, line 86
curl -s "https://$TARGET/horizon/api/jobs/failed" | python3 -m json.tool 2>/dev/null | head -50 - skills/hunt-laravel/SKILL.md, line 91
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$path") - skills/hunt-laravel/SKILL.md, line 102
curl -s "https://$TARGET/.env" | grep -i "APP_KEY\|DB_PASSWORD\|SECRET\|KEY" - skills/hunt-laravel/SKILL.md, line 103
curl -s "https://$TARGET/.env.production" - skills/hunt-laravel/SKILL.md, line 104
curl -s "https://$TARGET/.env.backup" - skills/hunt-laravel/SKILL.md, line 105
curl -s "https://$TARGET/.env.local"
and 9 more places
Runs commands on your computer
The author does not mention this. Expected for a security skill.
Found in 8 places.
Show 5 more
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'hunt-laravel' ] || [ -L ~/.agents/skills/'hunt-laravel' ]; then echo 'A skill folder named hunt-laravel already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet '8ac4242ee0a108e65ac1343b56cce6c50ba456ef' -- 'skills/hunt-laravel' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/hunt-laravel' ~/.agents/skills/'hunt-laravel' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hunt-laravel' ~/.claude/skills/'hunt-laravel' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)
Score history
| Date | Version | Score |
|---|
| 2026-11-14 | 8ac4242 | 90 |
| 2026-11-10 | d5dcc53 | 90 |
| 2026-11-08 | 42a3ab1 | 90 |
| 2026-11-06 | 3e71af0 | 90 |