Screened · automated checks passed
hunt-business-logic
What the author says it does
Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart price tampering (Upserve, Eternal/Zomato), decimal/fraction price-field overflow (Shipt), client-side checkout amount trust on PayPal redirect (WordPress.org), price-per-unit mass-assignment (Krisp), and archived-price swap / cart-TOCTOU (Stripe). Use when hunting business logic — heavy emphasis on financial-impact-demonstrated cases.
Quoted from the skill's own SKILL.md trigger description — this is what tells
Claude when to activate it. Not yet verified by us.
Automated screening
100/100 validator score
Scored by the same rules as our free SKILL.md validator: trigger description quality, body substance, structure. Automated — a human bench test is the next step in the pipeline.
Install (unverified — review first)
git clone https://github.com/elementalsouls/Claude-BugHunter # skill lives at: skills/hunt-business-logic/SKILL.md
SkillProof status
This skill is in our test queue. We install every skill in a clean environment, run a trigger battery and score output against a baseline before it earns a catalog page — the full protocol is public. Until then, treat it like any unreviewed dependency: read the SKILL.md and any scripts before installing.
Already tested in Productivity & Workflow
- Fetch URL As Markdown Local trafilatura-first URL-to-Markdown fetcher with a clean exit-code contract for when to fall back to Exa.
- Refresh Context Map Rebuilds the AIDEV-anchor/AGENTS.md/ADR manifest that powers claude-leverage's PreToolUse context hook.
- Video Vision Local ffmpeg+Whisper pipeline that lets Claude actually watch and transcribe video files
- YT Digest Turns a YouTube URL into a timestamped, screenshotted markdown research note via real yt-dlp + ffmpeg.