{"slug":"elementalsouls-hunt-api-misconfig","source_name":"elementalsouls/hunt-api-misconfig","name":"Elementalsouls/Hunt API Misconfig","description":"Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this skill covers only non-crypto JWT handling. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, X","version":1,"lift":{"pass_rate_delta_pts":0,"pass_rate_pct":81.8,"total_cases":22,"passed_cases":18,"tokens_delta_pct":214.2,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-08-09T13:10:12.211551+00:00"},"skill_score":null,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":0,"with_pass_pct":81.8,"without_pass_pct":81.8,"tokens_delta_pct":214.2,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":22,"verdict":"mixed","never_hurt":false,"completed_at":"2026-08-09T13:10:12.211551+00:00","run_id":"fab67f18-0dfc-43f1-af59-8b68064f75e5","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":"NOASSERTION","install_count":0,"manifest_hash":"4e970a54cf07fca71034cbeee5f214e69a7575ed8b8b012f39aa2d5022d4b658","raw_url":"https://app.decimal.ai/s/elementalsouls-hunt-api-misconfig/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/elementalsouls-hunt-api-misconfig"}