{"slug":"elementalsouls-hunt-auth-bypass","source_name":"elementalsouls/hunt-auth-bypass","name":"Elementalsouls/Hunt Auth Bypass","description":"Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024), partner-portal cross-IdP assertion reuse (Slack), WordPress XMLRPC bypassing SSO (Uber), JWT alg-confusion HS256/RS256 (Jitsi), JWT signature-validation skip (Linktree, Newspack), and token-a","version":1,"lift":{"pass_rate_delta_pts":4.17,"pass_rate_pct":62.5,"total_cases":24,"passed_cases":15,"tokens_delta_pct":398.4,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-08-04T18:59:48.986657+00:00"},"skill_score":0.625,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":4.17,"with_pass_pct":62.5,"without_pass_pct":58.3,"tokens_delta_pct":398.4,"turns_delta_pct":0,"total_cases":24,"cases_aggregated":24,"verdict":"mixed","never_hurt":false,"completed_at":"2026-08-04T18:59:48.986657+00:00","run_id":"90343f21-8068-4bc8-9156-4481f05b5a97","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":"NOASSERTION","install_count":0,"manifest_hash":"0f041c43bdf341c4487f872452352ee04ab5fceb53312968fdb45f52c2e6449a","raw_url":"https://app.decimal.ai/s/elementalsouls-hunt-auth-bypass/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/elementalsouls-hunt-auth-bypass"}