Claude-AgentHunter

In the author's own words, from each skill's SKILL.md.

• ai-agent-methodology

  Master orchestrator for AI-agent red-team assessments — enterprise copilots, DevOps/SRE agents, RAG assistants, coding/IDE agents, MCP/A2A tool servers, autonomous workflow agents. Load at the START of any agent test, when facing a new agent target, or when unsure what to test next. Routes to the hunt-agent-* skills by tool surface and architecture, and enforces the discipline that makes findings…

  skills/ai-agent-methodology/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-auth-bypass

  Authorization bypass in AI-agent tools — role/persona claims, unverifiable named-credential exceptions, privilege fields inside attacker-supplied credential documents, privilege escalation via prompt injection, data-classification override, and 'I-am-the-admin' attacks against prompt-level access control. Use when tools are gated by who is asking, or by a document the caller supplies, rather than…

  skills/hunt-agent-auth-bypass/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-blind-exfil

  Extract data from AI-agent tools that execute but hide output — status-only, exit-code-only, or DLP-filtered. Characterize FIRST (visibility, allowlist, egress), then pick a channel: OOB DNS/HTTP, DLP-bypass via an unfiltered tool, boolean exit-code oracle, or timing. The channel that works is the one the filter doesn't inspect.

  skills/hunt-agent-blind-exfil/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-browser-use

  Attacks specific to computer-use and browser agents — agents that see a screen/DOM and act by clicking, typing, and navigating (AI browsers like Comet/Atlas, ChatGPT Operator, Claude Computer-Use, RPA copilots). Covers indirect injection through rendered page content the agent reads as instructions, screenshot/OCR-smuggled instructions invisible to humans, adversarial-pixel perturbation of a sing…

  skills/hunt-agent-browser-use/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-brute-force

  Brute-force and rate-limiting weaknesses in AI-agent tools — PIN/token/password guessing with no lockout, and feedback oracles (correct-digit / too-high-low / Mastermind-style) that collapse the search space. Use when a tool accepts guesses and returns feedback without throttling.

  skills/hunt-agent-brute-force/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-config-poisoning

  The agent's OWN configuration, instruction, and settings files as an attack surface — CLAUDE.md / AGENTS.md / .cursorrules / copilot-instructions.md, .vscode/settings.json, .claude/settings.json, .cursor/mcp.json / .mcp.json, hooks, and allowlist/YOLO toggles. A repo, doc, or upstream agent plants instructions or config the agent reads and trusts, so it emits backdoored code, disables its own gua…

  skills/hunt-agent-config-poisoning/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-crypto

  Cryptographic weaknesses in AI-agent tools that encrypt/decrypt/sign or mint tokens — ECB cut-and-paste and byte-at-a-time, padding oracles, missing MAC, hardcoded keys/predictable IVs. Use when an agent exposes crypto operations as tools.

  skills/hunt-agent-crypto/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-deserialization

  Unsafe deserialization in AI-agent tools that parse structured data — YAML, pickle, JSON, XML, TOML — via tool parameters, AND poisoned model/dataset artifacts loaded from a hub (Hugging Face / registry pickle: torch.load, .pkl/.pt/.ckpt). Identify the runtime, pick the matching gadget, PROVE code execution (not 'it parsed'). Any agent tool that ingests serialized config/data, or loads model weig…

  skills/hunt-agent-deserialization/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-guardrail-evasion

  Cross-cutting techniques for getting a payload past input/output guardrails — safety classifiers, refusal training, moderation filters, DLP. Encoding/obfuscation, Unicode-tag/ASCII smuggling, low-resource-language, adversarial suffixes (GCG), payload splitting/token smuggling, roleplay/refusal-suppression, many-shot, and Crescendo multi-turn escalation. This is an AMPLIFIER, not a standalone find…

  skills/hunt-agent-guardrail-evasion/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-hitl-bypass

  Defeating the human-in-the-loop approval gate — the last line of defense before a consequential agent action (payment, deploy, delete, email, privilege grant). Approval-summary manipulation (approve X, agent does Y), approval fatigue/batching, standing 'always-allow' scope creep, timeout-auto-approve, racing the approval window, social-engineering the approver, and unguarded sibling paths to the…

  skills/hunt-agent-hitl-bypass/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-info-disclosure

  Information disclosure in AI-agent tools — log/diagnostic leakage, environment dumps via multi-step diagnostic chains, path traversal, arbitrary file import, and secret-in-context. Every tool that returns data is a potential leak; a returned 'secret' may be confabulated — verify.

  skills/hunt-agent-info-disclosure/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-mcp-exposure

  MCP (Model Context Protocol) exposure in AI agents: direct resource access, tool enumeration, missing auth, session/Origin issues, protocol-level abuse, and the delegated-identity OAuth flows an MCP proxy runs — confused-deputy auth-code theft, token passthrough, SSRF via OAuth metadata discovery, and over-broad scopes. Bypass the agent, talk to the resource server directly, or abuse the proxy's…

  skills/hunt-agent-mcp-exposure/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-mcp-supply-chain

  Trust/supply-chain attacks on the MCP tool ecosystem an agent connects to — tool-description injection, rug-pull (tool mutates after approval), cross-server tool shadowing, line-jumping/name collision, confused-deputy via a malicious tool, token/consent theft, and injection delivered through tool RESULTS. Distinct from hunt-agent-mcp-exposure (probing one exposed server): here the server/tool its…

  skills/hunt-agent-mcp-supply-chain/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-memory-poisoning

  Persistent poisoning of an AI agent's long-term memory / stored profile / writable knowledge — so injected content survives across sessions (and sometimes across users) and re-fires without re-injection. Covers direct memory-write injection, indirect auto-memorization, persistent exfil ('spAIware'), cross-user/shared-memory contamination, and fact poisoning. The finding requires crossing the sess…

  skills/hunt-agent-memory-poisoning/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-multi-agent

  Cross-agent trust, privilege, and shared-state abuse in multi-agent systems, including A2A (Agent-to-Agent) protocol exposure. Confused-deputy across agents, privileged-tool reach via a 'clearance'/orchestrator agent, direct A2A/agent-card access, indirect prompt injection through shared context/memory, and shared-state races. Use when a target has >1 agent, an orchestrator/sub-agent split, an A2…

  skills/hunt-agent-multi-agent/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-native-memory

  Memory-safety exploitation of the NATIVE program behind an agent tool — stack/heap overflow, pointer and length-field corruption, leaked addresses in tool output, and ret2shellcode/ROP through an MCP or function-calling interface. Use when a tool wraps a compiled binary, a legacy service, or any non-managed runtime (C/C++/Rust-unsafe/CGO), when a tool echoes raw pointers or crashes on large input…

  skills/hunt-agent-native-memory/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-output-exfil

  Client-side data exfiltration through AI-agent OUTPUT rendered in a UI — zero-click markdown-image exfil, HTML/img-src injection, one-click hyperlink exfil, and CSP/allowlist bypass. The agent is induced (usually via prompt injection) to emit markup that the victim's client auto-fetches, leaking context/secrets from the victim's authenticated session. Confirmed only by an OOB callback carrying th…

  skills/hunt-agent-output-exfil/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-prompt-extraction

  Extract an AI agent's system prompt, tool contract, hidden instructions, and embedded secrets — and tell a real leak from a confabulation. Structural extraction (quote-the-Nth-sentence), guardrail-vs-filter distinction, and the run-twice reproducibility gate. Use to map what the agent knows/does before exploiting its tools, or when a secret may live in context.

  skills/hunt-agent-prompt-extraction/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-prompt-injection

  Prompt injection in AI agents — direct (chat box is the trust boundary), indirect (payload planted in data the agent later reads: docs, web pages, emails/tickets, RAG chunks, tool output), multimodal (image/audio/file, ASCII/Unicode-tag smuggling), and multi-turn jailbreaks (crescendo, many-shot, skeleton-key). The #1 agent risk. Injection alone is Informational — score every finding by the SINK…

  skills/hunt-agent-prompt-injection/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-race-condition

  TOCTOU / race conditions in AI-agent tools: double-spend, limit bypass, coupon reuse, privilege flip, inventory oversell — any stateful agent where check and commit aren't atomic. Fire operations in parallel (single-packet beats an LLM 'do it simultaneously' prompt) and PROVE the shared state changed.

  skills/hunt-agent-race-condition/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-rag

  Attacks on retrieval-augmented agents and their vector stores — knowledge/corpus poisoning, indirect injection via retrieved chunks, cross-tenant/access-control retrieval bypass (IDOR at the embedding layer), ranking manipulation, embedding inversion/membership inference, and citation spoofing. The dominant enterprise pattern. A poisoned doc that's never retrieved, or a 'retrieved' doc the model…

  skills/hunt-agent-rag/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-resource-abuse

  Unbounded-consumption / denial-of-wallet attacks on agents — forcing expensive token generation, recursive/agent-fan-out loops, unbounded context/retrieval, costly downstream tool calls, and shared-quota exhaustion that degrades service for other tenants. The finding is a MEASURED cost or availability impact with an amplification ratio, not 'it felt slow'. Prove the multiplier and extrapolate; do…

  skills/hunt-agent-resource-abuse/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-time-gate

  Temporal-constraint bypass in AI-agent tools — future-dating, weekend/maintenance-window evasion, rate-reset manipulation. Time gates enforced as prompt instructions are not real time locks. A TOCTOU variant: cross-check hunt-agent-race-condition before double-reporting.

  skills/hunt-agent-time-gate/SKILL.md on GitHub (opens in a new tab)

• hunt-agent-tool-injection

  Command/code injection in AI-agent tools — shell, Python/JS eval, SQL, SSRF via fetch tools. Covers separators, the newline bypass and the shell-vs-agent-extraction ambiguity that decides whether substitution fires, denylist bypass, the exit-code oracle, and the browser-vs-API gap. The agent lies about how it handles your input — verify by effect.

  skills/hunt-agent-tool-injection/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 385k stars · 1 skill
• ECCby affaan-m The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Cod… 289k stars · 30 skills
• andrej-karpathy-skillsby multica-ai A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls. 224k stars · 1 skill
• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 176k stars · 6 skills
• ui-ux-pro-max-skillby nextlevelbuilder An AI skill that provides design intelligence for building professional UI/UX across multiple platforms. 140k stars · 7 skills
• graphifyby Graphify-Labs Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Curs… 135k stars · 1 skill