Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →elementalsouls/hunt-source-leak
Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint discovery, .env/.git exposure, webpack chunks with hardcoded secrets, robots.txt/security.txt recon, build-info files, asset-manifest.json API route discovery, .DS_Store file listing. Use at the START of every recon session — these findings often unlock the entire attack surface.
Passed 21 of 22 test cases with the skill, and 17 of 22 without it.
and 1 more in the full report
4 fixed17 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
When testing for JS map files on a frontend application where filenames use content hashing, an engineer sees that an old map URL returns a 404 status. What step must be performed before concluding that source maps are disabled?
| Checked | Without skill | With skill |
|---|---|---|
| The response explains that the current build hash must be resolved live from active HTML bundle references | Missed | Passed |
The instructions your model reads when the skill loads.
Source map exposing TypeScript source = see all API routes, auth logic, secrets. Swagger/OpenAPI JSON = complete API surface map.
Highest-value findings:
.js.map source maps — reconstruct full TypeScript/ES6 source code → find hardcoded API keys, internal endpoints, auth logic bypassesswagger.json / openapi.json — complete REST API specification with all endpoints, parameters, auth schemes, and internal route names.env / .env.production — APP_KEY, DB_PASSWORD, API_KEY, SECRET_KEY in plaintext.git/ exposure — git clone the entire source history → all past hardcoded secretsasset-manifest.json / _next/static/ — all JS bundle paths → systematic source map discoverybuild-info / info.json — git commit hash, build timestamp, dependency versions → CVE targeting# These 10 requests take <30 seconds and often yield Critical findings
for PATH in \
"/.env" \
"/.env.production" \
"/.env.local" \
"/.git/HEAD" \
"/swagger.json" \
"/api/swagger.json" \
"/v1/swagger.json" \
"/openapi.json" \
"/api/openapi.json" \
"/api-docs"; do
STATUS=$(curl -s -o /tmp/sl_test -w "%{http_code}" "https://$TARGET$PATH")
if [ "$STATUS" = "200" ]; then
echo "[+] HIT: https://$TARGET$PATH"
head -5 /tmp/sl_test
echo "---"
fi
done
test cases passed, vs 17 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.