Hackz Huntkit
Description
Offensive-security playbooks for AI coding agents — IDOR, 403 bypass, CORS, finding validation and dupe-checking. MIT. Works in Claude Code, Cursor, Copilot, Codex, Gemini, Zed and the AGENTS.md standard.
Installation
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open the source below and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
README
HuntKit
Offensive-security playbooks for AI coding agents — written during real engagements, sanitised, and packaged for every major agent format.
**MIT licensed. Free. No sign-up, no telemetry, no network calls.**
claude plugin marketplace add https://github.com/krishnextgencyber/hackz-huntkit
claude plugin install huntkit-free@huntkitWhat's in it
| Playbook | What it's for |
|---|---|
hunt-idor |
IDOR / BOLA — object-id tampering, cross-user reads and writes, and the chain from a leaked id to account takeover |
hunt-403-bypass |
403 / 401 bypass — path normalization, proxy header confusion, verb tampering, gateway-vs-origin splits |
hunt-cors |
CORS misconfiguration — origin reflection, null origin, regex bypass, and a credentialed cross-origin read proven in a real browser |
triage-validation |
The gate between "I found something" and "this is reportable" |
duplicate-check |
Prior-art search that actually finds the duplicate before a triager does |
Why these five
Two of them are not vulnerability classes at all, and that is the point.
An agent that "finds" ten bugs and can prove none of them wastes everyone's time — the researcher's, the triager's, and the vendor's. `triage-validation` and `duplicate-check` exist to make the agent **demonstrate** a finding rather than assert one, and to check whether someone reported it in 2023 before you write it up.
The class playbooks carry bypass tables, real payloads, and the chain from primitive to demonstrated impact — not a checklist of things to try.
Install anywhere
Every agent format is built from the same source and verified against it on each release.
| Tool | Path |
|---|---|
| Claude Code | the plugin marketplace command above |
| opencode · Codex CLI · Gemini CLI | cp -r dist-platforms/free/skills/* — all three read the same SKILL.md layout |
| Cursor | dist-platforms/free/cursor/.cursor/rules/ |
| Windsurf | `dist-platforms/free |
Related Skills
Fastapi Review
Review a FastAPI application for architecture, async correctness, dependency injection, Pydantic schemas, secu
Defense in Depth
Implement multi-layered testing and security best practices.
SecLists Official Repository
[OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
Threat Hunting with Sigma Rules
Use Sigma detection rules to hunt for threats and analyze security events
Maintenance Walkthrough - 2026-03-29
- Re-triaged the full 2026-03-15 security finding set against current `main` and wrote a fresh current-head re
Google Workspace Model Armor
Filter user-generated content for safety
