hunt-shadow-api

90 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53

Hunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy paths, header- and subdomain-based versioning), pull and diff every reachable OpenAPI/Swagger spec (including ones only findable via the Wayback Machine), and behaviorally diff old vs. current versions for auth/rate-limit/validation regressions rather than just response-shape differences. Distinct from hunt-api-misconfig, which owns exploitation …

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 4 places.

skills/hunt-shadow-api/SKILL.md, line 35for v in v1 v2 v3 v4 beta alpha internal legacy old 2022-01-01 2023-01-01 2024-01-01; do
skills/hunt-shadow-api/SKILL.md, line 57for path in openapi.json swagger.json v1/swagger.json v2/swagger.json v3/api-docs \
skills/hunt-shadow-api/SKILL.md, line 70jq -r '.paths | keys[]' v1-swagger.json | sort > /tmp/v1_paths.txt

Show 1 more

skills/hunt-shadow-api/SKILL.md, line 89curl -s -H "Authorization: Bearer $EXPIRED_TOKEN" https://$TARGET/api/v1/users/me -w '\n%{http_code}\n'

Sends data to these websites: $target, $sub.$target, web.archive.org

The author does not mention this. Expected for a security skill.

Found in 9 places.

skills/hunt-shadow-api/SKILL.md, line 36curl -s -o /dev/null -w "%{http_code} /api/$v/\n" "https://$TARGET/api/$v/"
skills/hunt-shadow-api/SKILL.md, line 40curl -s -H "X-API-Version: 1" https://$TARGET/api/users
skills/hunt-shadow-api/SKILL.md, line 41curl -s -H "Accept: application/vnd.company.v1+json" https://$TARGET/api/users

Show 6 more

skills/hunt-shadow-api/SKILL.md, line 45curl -s -o /dev/null -w "%{http_code} $sub\n" "https://$sub.$TARGET/"
skills/hunt-shadow-api/SKILL.md, line 59curl -s -o /dev/null -w "%{http_code} /$path\n" "https://$TARGET/$path"
skills/hunt-shadow-api/SKILL.md, line 63curl -s "http://web.archive.org/cdx/search/cdx?url=$TARGET/*swagger*&output=json&collapse=urlkey"
skills/hunt-shadow-api/SKILL.md, line 64curl -s "http://web.archive.org/cdx/search/cdx?url=$TARGET/*openapi*&output=json&collapse=urlkey"
skills/hunt-shadow-api/SKILL.md, line 89curl -s -H "Authorization: Bearer $EXPIRED_TOKEN" https://$TARGET/api/v1/users/me -w '\n%{http_code}\n'
skills/hunt-shadow-api/SKILL.md, line 90curl -s -H "Authorization: Bearer $EXPIRED_TOKEN" https://$TARGET/api/v2/users/me -w '\n%{http_code}\n'

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'hunt-shadow-api' ] || [ -L ~/.agents/skills/'hunt-shadow-api' ]; then echo 'A skill folder named hunt-shadow-api already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/hunt-shadow-api' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/hunt-shadow-api' ~/.agents/skills/'hunt-shadow-api' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hunt-shadow-api' ~/.claude/skills/'hunt-shadow-api' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.

SkillTrust badge for elementalsouls/Claude-BugHunter

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/elementalsouls/Claude-BugHunter.svg)](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)

Score history

Date	Version	Score
2026-11-10	`d5dcc53`	90
2026-11-08	`42a3ab1`	90
2026-11-06	`3e71af0`	70