hunt-core
From the author
Shared discipline for every hunt-* skill: scope and authorization gating, the two-account rule, the confirmation gate that separates a real finding from a false positive, enumeration limits, stop conditions, marker discipline, wiki-first query and self-heal, FIND output, Deadends, and wiki distillation. ALWAYS LOADED alongside any hunt skill. Also trigger directly on "is this in scope", "is this a real bug", "how do I confirm this", "should I keep going", "how many IDs should I test", "what severity", "how do I report this", "I got someone else's data". Every hunt-* skill assumes this file; without it they run without their safety and quality layer.
Install
npx skills add Encod3d-Sec/TORCH --skill hunt-core -a claude-code
Installs to .claude/skills/hunt-core/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 83
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- hunt-idorsickn33/agentic-awesome-skillsHunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.Security★ 48.4K
- trading-disciplinekansoku-trade/kansokuCross-context shared trading discipline — output language, independent verification, scenarios not points, noise filtering, intent-attribution guardrails, and execution discipline (trend alignment, R:R floor, exit protection, verifiable reasons). Injected into both the app-side judgment agents (analyst / deepDive / chat) and the bench episode runner. Context-specific chapters live under references/ and are loaded on demand by the caller (app or bench).Finance★ 329
- hunt-xsselementalsouls/Claude-BugHunterHunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflects raw HTML but does NOT execute JavaScript (no `<script>`/event-handler execution), see hunt-html-injection — escalate here once script execution is possible.Security★ 5.2K
- hunt-miscsickn33/agentic-awesome-skillsHunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target.Security★ 48.4K
- learnEncod3d-Sec/TORCHPost-engagement knowledge harvest AND harness retrospective - after a box/bugbounty/pentest/CTF is completed, first diff how the engagement was EXECUTED against the skills/hooks that governed it (what discipline was skipped) and improve the harness, then sweep the whole engagement for GENERIC reusable knowledge NOT already in wiki/ and land it via the leak-gated stage->promote pipeline. Use at close-out or when asked to "extract learnings", "what did we learn", "harvest lessons into wiki", "distill this engagement", "post-mortem into the wiki", "what did we do wrong", "improve the harness from this box".Security★ 334
- hunt-xxesickn33/agentic-awesome-skillsHunting skill for xxe vulnerabilities.Security★ 48.4K
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in