OpenAgentSkill Registry Manifest
Skill: hunt-api-misconfig
Slug: elementalsouls-hunt-api-misconfig
Category: security
Description: Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this skill covers only non-crypto JWT handling. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, XSS in browser). HTTP verb: GET-bypass-CSRF, X-HTTP-Method-Override, TRACE enabled. Detection: API responses with extra fields, JWTs in headers (decode at jwt.io). CORS misconfiguration (reflect-any-origin, null origin, subdomain-regex bypass, postMessage) is owned by hunt-cors. Use when hunting API misconfigs, mass-assignment, prototype pollution (JWT crypto → hunt-jwt-crypto).

Agent fit:
- Decision: 94/100 Production-ready
- Primary fit: Research agents
- Role: Primary pick

Supply profile:
- Track: Research and knowledge work
- Scenario: Research agents
- Applicable agents: Claude Code, Browser agents, CLI, Codex, Cursor
- Maintenance: 6d since push
- Risk: Needs review

Trust:
- Trust score: 66/100 Manual review
- Audit: 79/100 Needs review

Attribution:
- Status: Registry indexed
- Source: github candidate review
- Creator: elementalsouls
- Claim URL: https://www.openagentskill.com/skills/elementalsouls-hunt-api-misconfig#claim-this-skill

Install:
npx skills add elementalsouls/Claude-BugHunter --skill hunt-api-misconfig

URLs:
- Web: https://www.openagentskill.com/skills/elementalsouls-hunt-api-misconfig
- API: https://www.openagentskill.com/api/agent/skills/elementalsouls-hunt-api-misconfig
- Install API: https://www.openagentskill.com/api/skills/elementalsouls-hunt-api-misconfig/install
- Repository: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-api-misconfig