← All skills
hunt-session
94 / 100 · Low risk
Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53
Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token rotation/reuse-detection gaps, OAuth/SSO session linkage, device-bound-session (DBSC) downgrade, and cookie attribute issues (Secure/HttpOnly/SameSite/__Host-). Validate with TWO real sessions (attacker A + victim B), body-diff every 200, and OOB co…
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 9 places.
Show 6 more
Sends data to these websites: $target
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 19 places.
Show 16 more
- skills/hunt-session/SKILL.md, line 134
curl -s -L -c "$JAR_A" -X POST "https://$TARGET/api/login" \ - skills/hunt-session/SKILL.md, line 140
BEFORE=$(curl -s -L -b "$JAR_A" "https://$TARGET/api/me") - skills/hunt-session/SKILL.md, line 143
curl -s -L -b "$JAR_A" -X POST "https://$TARGET/api/logout" -o /dev/null - skills/hunt-session/SKILL.md, line 147
AFTER=$(curl -s -L -H "Cookie: $A" "https://$TARGET/api/me" -w '\n[%{http_code}]') - skills/hunt-session/SKILL.md, line 163
curl -s -L -c "$JAR_A" -X POST "https://$TARGET/api/login" \ - skills/hunt-session/SKILL.md, line 167
BEFORE=$(curl -s -L -H "Cookie: $SESSION_A" "https://$TARGET/api/profile") - skills/hunt-session/SKILL.md, line 170
curl -s -L -c "$JAR_B" -X POST "https://$TARGET/api/login" \ - skills/hunt-session/SKILL.md, line 175
curl -s -L -b "$JAR_B" -X POST "https://$TARGET/api/change-password" \ - skills/hunt-session/SKILL.md, line 180
AFTER=$(curl -s -L -H "Cookie: $SESSION_A" "https://$TARGET/api/profile" -w '\n[%{http_code}]') - skills/hunt-session/SKILL.md, line 191
curl -sI -L "https://$TARGET/" | grep -i '^set-cookie' - skills/hunt-session/SKILL.md, line 205
curl -s -L -c "$J" "https://$TARGET/login" -o /dev/null - skills/hunt-session/SKILL.md, line 233
RT1=$(curl -s -L -X POST "https://$TARGET/api/login" \ - skills/hunt-session/SKILL.md, line 238
R2=$(curl -s -L -X POST "https://$TARGET/auth/refresh" \ - skills/hunt-session/SKILL.md, line 243
REPLAY=$(curl -s -L -X POST "https://$TARGET/auth/refresh" \ - skills/hunt-session/SKILL.md, line 249
curl -s -L -X POST "https://$TARGET/auth/refresh" \ - skills/hunt-session/SKILL.md, line 261
curl -s -L -H "Cookie: $A" "https://$TARGET/api/me" -w '\n[%{http_code}]'
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'hunt-session' ] || [ -L ~/.agents/skills/'hunt-session' ]; then echo 'A skill folder named hunt-session already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/hunt-session' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/hunt-session' ~/.agents/skills/'hunt-session' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hunt-session' ~/.claude/skills/'hunt-session' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)
Score history
| Date | Version | Score |
|---|
| 2026-11-10 | d5dcc53 | 94 |
| 2026-11-08 | 42a3ab1 | 94 |
| 2026-11-06 | 3e71af0 | 94 |