Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →elementalsouls/hunt-misc
Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports.
Passed 20 of 23 test cases with the skill, and 17 of 23 without it.
and 2 more in the full report
3 fixed17 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
Can you provide a technical testing guide for evaluating enterprise authentication integration security, specifically focusing on SAML assertion parsing, token scope enforcement, and header injection points? The response should be organized into attack surface indicators, manual testing steps, root cause breakdowns, and concrete impact assessment rules.
| Checked | Without skill | With skill |
|---|---|---|
| Explains SAML signature bypass risks arising from parser differentials between XML signature verification libraries and business logic parsers. | Passed | Passed |
| Instructs testing token scope enforcement by calling write actions using minimal-scope or read-only tokens to detect missing per-endpoint checks. | Missed | Passed |
| Rejects status-code-only findings by requiring response body differentials to prove authorization bypasses. | Missed | Passed |
The instructions your model reads when the skill loads.
Why this vuln class pays: MISC vulnerabilities span access control failures, information disclosure, session/auth logic bugs, and misconfiguration — the categories that consistently produce the highest payouts because they map directly to business impact: data exposure, account takeover, privilege escalation, and infrastructure compromise.
Highest-value targets:
Asset types that pay most:
URL patterns to watch:
/admin/*/transfer
/invitations/*
/partners/*/accept
/api/v*/repos/*/lfs/*
/-/settings/integrations/sentry
/api/v*/user/installations
/hooks/pre-receive/*
/reset-password?token=
/auth/saml/callback
/api/v*/packages/pypi/*
Response header signals:
X-Request-Id (pitchfork/Rack — check for header injection)
test cases passed, vs 17 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.