Hunt Exceptional Conditions Skill for Claude

Hunt mishandling of exceptional conditions — feed an endpoint malformed/unexpected input (wrong type, broken JSON, oversized field, null byte) and make it fail OPEN or leak internals: a verbose stack-trace / framework error page that discloses ORM internals, server file paths, library versions, or a language traceback. Use on any input-accepting endpoint (JSON APIs, forms, query params). Medium-High when the leak exposes internal structure that arms a deeper attack.

786 tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

3280

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-exceptional-conditions

The instruction itself

6 sections, as written by the author

HUNT-EXCEPTIONAL-CONDITIONS — Verbose Errors / Fail-Open (A10:2025)

What actually pays

Well-built apps catch errors and return a clean, generic message. A broken app,

when handed input it didn't expect, throws an unhandled exception and renders a

developer error page straight to the client — leaking the stack trace, the

ORM/query internals, server-side file paths, and framework/library versions.

That disclosure is the finding (and it arms SQLi/RCE/path attacks next).

Recon

Any endpoint that parses input is a candidate; the richest are:

JSON APIs that expect typed fields:  POST /api/* with {numbers, ids, enums}
Endpoints with numeric/id path or query params:  /item/{id}, ?page=, ?quantity=
Search / filter / sort params
File or content-type sensitive uploads

Attack — send what the code didn't anticipate

Take a known-good request and break ONE assumption at a time:

Wrong type: a field the app expects to be a number/string is sent as an

array or object — {"rating":"x","comment":[1,2,3]}, {"quantity":{}}.

Malformed body: truncated/!invalid JSON, an unterminated string, a stray

brace, a wrong/missing Content-Type.

Boundary/oversized: a very long string, a huge/negative/overflow number.
Null byte / control chars embedded in a value.

POST /api/Feedbacks   {"rating":"notanumber","comment":[1,2,3]}
GET  /item/' OR /item/%00   (also exercises the error path)

Watch the RESPONSE BODY, not just the status: a 500 (or even a 200/400) whose

body contains a stack trace or framework error page is the signal.

What counts as a leak (the success signal)

A finding is confirmed when the response body contains a cross-framework error-disclosure signature:

Node/Express + Sequelize: SequelizeDatabaseError, node_modules/sequelize,

a JS stack with internal paths.

PHP: <b>Warning</b> ... /var/www/.../file.php on line N.
Python: Traceback (most recent call last), werkzeug.exceptions.
Java: at com.app.Foo(Foo.java:42) stack frames.
.NET: Server Error in '/' Application, a [System.XxxException: ...] YSOD.

A clean JSON error ({"error":"Invalid input"}) with no internals is NOT a

finding — that's correct handling. Disclosure of internal structure is.

Validation discipline

Capture the exact leaked artifact (path, ORM class, version, stack frame) —

that's the evidence. "It returned 500" alone is not disclosure.

Note what the leak enables next (e.g. a disclosed SQL error → hunt-sqli; a

disclosed absolute path → hunt-lfi).

Other skills for the same job

different authors, same section of the catalogue

Bioservices

by christophacham

×3

Unified Python interface to 40+ bioinformatics services. Use when querying multiple databases (UniProt, KEGG, ChEMBL, Reactome) in a single workflow with consistent API. Best for cross-database analysis, ID mapping across services. For quick single-database lookups use gget; for sequence/file manipulation use biopython.

Python library for working with geospatial vector data including shapefiles, GeoJSON, and GeoPackage files. Use when working with geographic data for spatial analysis, geometric operations, coordinate transformations, spatial joins, overlay operations, choropleth mapping, or any task involving reading/writing/analyzing vector geographic data. Supports PostGIS databases, interactive maps, and integration with matplotlib/folium/cartopy. Use for tasks like buffer analysis, spatial joins between datasets, dissolving boundaries, clipping data, calculating areas/distances, reprojecting coordinate systems, creating maps, or converting between spatial file formats.

Fast CLI/Python queries to 20+ bioinformatics databases. Use for quick lookups: gene info, BLAST searches, AlphaFold structures, enrichment analysis. Best for interactive exploration, simple queries. For batch processing or advanced BLAST use biopython; for multi-database Python workflows use bioservices.

Direct REST API access to UniProt. Protein searches, FASTA retrieval, ID mapping, Swiss-Prot/TrEMBL. For Python workflows with multiple databases, prefer bioservices (unified interface to 40+ services). Use this for direct HTTP/REST work or UniProt-specific control.

BullMQ expert for Redis-backed job queues, background processing, and reliable async execution in Node.js/TypeScript applications. Use when: bullmq, bull queue, redis queue, background job, job queue.

2k tokens

Moodle External API Development

by ComeOnOliver

×2

Create custom external web service APIs for Moodle LMS. Use when implementing web services for course management, user tracking, quiz operations, or custom plugin functionality. Covers parameter validation, database operations, error handling, service registration, and Moodle coding standards.

How to use it

Copy the folder

Take elementalsouls/hunt-exceptional-conditions from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.