hunt-tls-network

79 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53

Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records. Most of these are Info/Low on their own — this skill is opinionated about which findings actually pay (spoofable DMARC with delivered-to-inbox proof, AXFR returning internal hosts, dangling-CNAME takeover) versus which get rejected as best-practic…

Works with any agent that supports SKILL.md skills.

What this skill can do

Downloads and installs other software

The author does not mention this.

Found in 4 places.

skills/hunt-tls-network/SKILL.md, line 32brew install testssl
skills/hunt-tls-network/SKILL.md, line 36pip3 install sslyze
skills/hunt-tls-network/SKILL.md, line 321brew install testssl

Show 1 more

skills/hunt-tls-network/SKILL.md, line 325pip3 install sslyze

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 11 places.

skills/hunt-tls-network/SKILL.md, line 32brew install testssl
skills/hunt-tls-network/SKILL.md, line 67curl -sI "https://$TARGET/" | grep -i "strict-transport-security"
skills/hunt-tls-network/SKILL.md, line 94dig NS $TARGET +short

Show 8 more

skills/hunt-tls-network/SKILL.md, line 116dig TXT $TARGET +short | grep "v=spf1"
skills/hunt-tls-network/SKILL.md, line 158swaks --to your-tester@gmail.com \
skills/hunt-tls-network/SKILL.md, line 178HEADERS=$(curl -sI "https://$TARGET/")
skills/hunt-tls-network/SKILL.md, line 202curl -s "https://crt.sh/?q=%25.$TARGET&output=json" | \
skills/hunt-tls-network/SKILL.md, line 223while read sub; do
skills/hunt-tls-network/SKILL.md, line 248dig CAA $TARGET +short
skills/hunt-tls-network/SKILL.md, line 266curl -sk "https://$TARGET/internal/" 2>&1 | grep -i "ssl\|certificate\|403\|401"
skills/hunt-tls-network/SKILL.md, line 321brew install testssl

Sends data to these websites: $target, $sub.$target, hstspreload.org, securityheaders.com, $target&followredirects=on, crt.sh, $sub, $target$path, mxtoolbox.com, dmarcian.com

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 14 places.

skills/hunt-tls-network/SKILL.md, line 67curl -sI "https://$TARGET/" | grep -i "strict-transport-security"
skills/hunt-tls-network/SKILL.md, line 72HSTS=$(curl -sI "https://$sub.$TARGET/" 2>/dev/null | grep -i "strict-transport-security")
skills/hunt-tls-network/SKILL.md, line 81curl -sI "http://$TARGET/" | grep -i "location"

Show 11 more

skills/hunt-tls-network/SKILL.md, line 85curl -s "https://hstspreload.org/api/v2/status?domain=$TARGET" | python3 -m json.tool 2>/dev/null
skills/hunt-tls-network/SKILL.md, line 178HEADERS=$(curl -sI "https://$TARGET/")
skills/hunt-tls-network/SKILL.md, line 192curl -s "https://securityheaders.com/?q=https://$TARGET&followRedirects=on" | \
skills/hunt-tls-network/SKILL.md, line 202curl -s "https://crt.sh/?q=%25.$TARGET&output=json" | \
skills/hunt-tls-network/SKILL.md, line 226CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 8 "https://$sub/" 2>/dev/null)
skills/hunt-tls-network/SKILL.md, line 266curl -sk "https://$TARGET/internal/" 2>&1 | grep -i "ssl\|certificate\|403\|401"
skills/hunt-tls-network/SKILL.md, line 269curl -sk --cert "" "https://$TARGET/internal/api" | head -5
skills/hunt-tls-network/SKILL.md, line 273STATUS=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path")
skills/hunt-tls-network/SKILL.md, line 288curl -sk "https://$TARGET/internal/api" -H "$H1" -H "$H2" -o /dev/null -w "%{http_code}\n"
skills/hunt-tls-network/SKILL.md, line 328curl -s "https://mxtoolbox.com/api/v1/Lookup/spf?argument=$TARGET" 2>/dev/null
skills/hunt-tls-network/SKILL.md, line 331curl -s "https://dmarcian.com/dmarc-inspector/?domain=$TARGET" 2>/dev/null

Safer alternatives

Low-risk skills in the same category (security) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'hunt-tls-network' ] || [ -L ~/.agents/skills/'hunt-tls-network' ]; then echo 'A skill folder named hunt-tls-network already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/hunt-tls-network' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/hunt-tls-network' ~/.agents/skills/'hunt-tls-network' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hunt-tls-network' ~/.claude/skills/'hunt-tls-network' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.

SkillTrust badge for elementalsouls/Claude-BugHunter

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/elementalsouls/Claude-BugHunter.svg)](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)

Score history

Date	Version	Score
2026-11-10	`d5dcc53`	79
2026-11-08	`42a3ab1`	79
2026-11-06	`3e71af0`	79