{"slug":"elementalsouls-hunt-subdomain","source_name":"elementalsouls/hunt-subdomain","name":"Elementalsouls/Hunt Subdomain","description":"Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issue (1-click OAuth ATO via wildcard `reply_to`, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel `cname.vercel-dns.com` deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover — emp","version":1,"lift":{"pass_rate_delta_pts":21.74,"pass_rate_pct":100,"total_cases":23,"passed_cases":23,"tokens_delta_pct":348,"turns_delta_pct":0,"verdict":"pass","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-08-09T13:49:49.869578+00:00"},"skill_score":1,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":21.74,"with_pass_pct":100,"without_pass_pct":78.3,"tokens_delta_pct":348,"turns_delta_pct":0,"total_cases":23,"cases_aggregated":22,"verdict":"pass","never_hurt":true,"completed_at":"2026-08-09T13:49:49.869578+00:00","run_id":"dbd5fdc2-5837-4427-a55d-e829f84bc7d4","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":"NOASSERTION","install_count":0,"manifest_hash":"34e2eb35e88b15e62e1ac60ccfc50ae2c047da0c6d3897d359a33a6ab3202022","raw_url":"https://app.decimal.ai/s/elementalsouls-hunt-subdomain/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/elementalsouls-hunt-subdomain"}