Home / Skills / hunt-api-misconfig
hunt-api-misconfig
elementalsouls/Claude-BugHunterSkill
Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this skill covers only non-crypto JWT handling. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, XSS in browser). HTTP verb: GET-bypass-CSRF, X-HTTP-Method-Override, TRACE enabled. Detection: API re
Why this score
This repo hosts 10 skills, so its 5,176 stars are split between them (about 518 each) for scoring.
Popularity score: 77/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank
Security
Scanned Oct 20, 2026 at commit dce681c32a7e, with Cisco's open-source skill-scanner.
None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.
A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan
Alternatives
Other makers' add-ons that do the same job, next to this one.
| Name | Score | Stars | Context | Updated |
|---|---|---|---|---|
| This onehunt-api-misconfig elementalsouls/Claude-BugHunter · Skill | 77 | ★ 5.2k | ≈155 always | 16d ago |
| hunt-api Encod3d-Sec/TORCH · Skill Both about hunt and mass | 59 | ★ 333 | ≈54 always | 2mo ago |
| hunt tw93/Waza · Skill Both about hunt | 77 | ★ 7.3k | ≈35 always | 17d ago |
| hunt-comments dealfluence/adeu · Skill Both about hunt | 65 | ★ 168 | ≈34 always | 17d ago |
| web3-case-study-role-misconfig tradecatlabs/vibe-coding-cn · Skill Both about misconfig and role | 79 | ★ 18k | ≈46 always | 16d ago |
| itchio-new-game-hunt kennyzir/7deer_skills · Skill Both about hunt | 61 | ★ 326 | ≈50 always | 1mo ago |