Screened · automated checks passed
hunt-laravel
What the author says it does
Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard unauthorized access, Ignition RCE (CVE-2021-3129), Signed URL manipulation, Queue Worker abuse, mass assignment via Eloquent, deserialization via cookies, .env file exposure. Use when target runs Laravel (PHP) — detected via X-Powered-By, Laravel session cookies, or /storage/ paths.
Quoted from the skill's own SKILL.md trigger description — this is what tells
Claude when to activate it. Not yet verified by us.
Automated screening
100/100 validator score
Scored by the same rules as our free SKILL.md validator: trigger description quality, body substance, structure. Automated — a human bench test is the next step in the pipeline.
Install (unverified — review first)
git clone https://github.com/elementalsouls/Claude-BugHunter # skill lives at: skills/hunt-laravel/SKILL.md
SkillProof status
This skill is in our test queue. We install every skill in a clean environment, run a trigger battery and score output against a baseline before it earns a catalog page — the full protocol is public. Until then, treat it like any unreviewed dependency: read the SKILL.md and any scripts before installing.
Already tested in Data & Analytics
- Statistical Analysis Enforces frame-inspect-check-assumptions-effect-size-APA-report pipeline for hypothesis tests; bundled Shapiro-Wilk/Levene's script actually runs.
- CocoIndex Turns vague 'build me a RAG pipeline' requests into working CocoIndex flow code with the real API syntax.
- Crawl4AI Wraps the Crawl4AI browser scraper for JS-heavy sites, batch crawls, and LLM-free schema extraction.
- National Team Position Fetches real Shanghai Exchange ETF-share data to estimate China's 'national team' broad-base ETF positioning.