hunt-source-leak

75 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53

Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint discovery, .env/.git exposure, webpack chunks with hardcoded secrets, robots.txt/security.txt recon, build-info files, asset-manifest.json API route discovery, .DS_Store file listing. Use at the START of every recon session — these findings often unlock the entire attack surface.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 8 places.

skills/hunt-source-leak/SKILL.md, line 28for PATH in \
skills/hunt-source-leak/SKILL.md, line 81curl -s "https://$TARGET/asset-manifest.json" | python3 -m json.tool 2>/dev/null
skills/hunt-source-leak/SKILL.md, line 123SWAGGER_PATHS=(

Show 5 more

skills/hunt-source-leak/SKILL.md, line 159curl -s "https://$TARGET/.git/HEAD" | grep -q "ref:" && echo "[+] .git exposed!"
skills/hunt-source-leak/SKILL.md, line 181DEBUG_PATHS=(
skills/hunt-source-leak/SKILL.md, line 213curl -s "https://$TARGET/.DS_Store" | xxd | head -10
skills/hunt-source-leak/SKILL.md, line 236curl -s https://$TARGET/ | grep -oP '"[^"]*\.chunk\.js"' | tr -d '"' | while read chunk; do
skills/hunt-source-leak/SKILL.md, line 273pip3 install git-dumper

Sends data to these websites: $target$path, $target, $target$js_url, $target$chunk

The author does not mention this. Expected for a security skill.

Found in 16 places.

skills/hunt-source-leak/SKILL.md, line 39STATUS=$(curl -s -o /tmp/sl_test -w "%{http_code}" "https://$TARGET$PATH")
skills/hunt-source-leak/SKILL.md, line 81curl -s "https://$TARGET/asset-manifest.json" | python3 -m json.tool 2>/dev/null
skills/hunt-source-leak/SKILL.md, line 82curl -s "https://$TARGET/static/js/main.*.js" 2>/dev/null | head -3

Show 13 more

skills/hunt-source-leak/SKILL.md, line 85BUILD_ID=$(curl -s https://$TARGET/ | grep -oP '"buildId":"\K[^"]+')
skills/hunt-source-leak/SKILL.md, line 86curl -s "https://$TARGET/_next/static/$BUILD_ID/_buildManifest.js" | head -5
skills/hunt-source-leak/SKILL.md, line 89for JS_URL in $(curl -s https://$TARGET/ | grep -oP 'src="[^"]*\.js"' | sed 's/src="//;s/"//'); do
skills/hunt-source-leak/SKILL.md, line 90LAST_LINE=$(curl -s "https://$TARGET$JS_URL" | tail -1)
skills/hunt-source-leak/SKILL.md, line 97curl -s "$MAP_URL" | python3 -c "
skills/hunt-source-leak/SKILL.md, line 136STATUS=$(curl -s -o /tmp/swagger_test -w "%{http_code}" "https://$TARGET$PATH")
skills/hunt-source-leak/SKILL.md, line 159curl -s "https://$TARGET/.git/HEAD" | grep -q "ref:" && echo "[+] .git exposed!"
skills/hunt-source-leak/SKILL.md, line 198STATUS=$(curl -s -o /tmp/debug_test -w "%{http_code}" "https://$TARGET$PATH")
skills/hunt-source-leak/SKILL.md, line 213curl -s "https://$TARGET/.DS_Store" | xxd | head -10
skills/hunt-source-leak/SKILL.md, line 236curl -s https://$TARGET/ | grep -oP '"[^"]*\.chunk\.js"' | tr -d '"' | while read chunk; do
skills/hunt-source-leak/SKILL.md, line 238curl -s "https://$TARGET$chunk" | \
skills/hunt-source-leak/SKILL.md, line 243curl -s "https://$TARGET/static/js/main.*.js" | \
skills/hunt-source-leak/SKILL.md, line 247curl -s "https://$TARGET/static/js/main.*.js" | \

Downloads and installs other software

The author does not mention this.

Found in 5 places.

skills/hunt-source-leak/SKILL.md, line 163pip3 install git-dumper
skills/hunt-source-leak/SKILL.md, line 216pip3 install ds_store
skills/hunt-source-leak/SKILL.md, line 273pip3 install git-dumper

Show 2 more

skills/hunt-source-leak/SKILL.md, line 277npm install -g source-map-explorer
skills/hunt-source-leak/SKILL.md, line 281npm install -g unwebpack-sourcemap

Safer alternatives

Low-risk skills in the same category (security) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'hunt-source-leak' ] || [ -L ~/.agents/skills/'hunt-source-leak' ]; then echo 'A skill folder named hunt-source-leak already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/hunt-source-leak' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/hunt-source-leak' ~/.agents/skills/'hunt-source-leak' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hunt-source-leak' ~/.claude/skills/'hunt-source-leak' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.

SkillTrust badge for elementalsouls/Claude-BugHunter

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/elementalsouls/Claude-BugHunter.svg)](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)

Score history

Date	Version	Score
2026-11-10	`d5dcc53`	75
2026-11-08	`42a3ab1`	75
2026-11-06	`3e71af0`	75