TyrusRC

Cua Hunt — Development skill for Claude Code

Development community

Hunt Computer-Use-Agent (CUA) prompt-injection surface — instructions planted in CUA-readable DOM channels (hidden text, aria-label, alt, noscript).

How to install Cua Hunt

Installs to ~/.claude/skills/tyrusrc-praetor-cua-hunt/SKILL.md

Terminal

mkdir -p ~/.claude/skills/tyrusrc-praetor-cua-hunt && curl -fsSL https://raw.githubusercontent.com/TyrusRC/praetor/HEAD/.claude/skills/cua-hunt.md -o ~/.claude/skills/tyrusrc-praetor-cua-hunt/SKILL.md

Restart Claude Code, or start a new session, for it to be picked up.

What Cua Hunt does

name: cua-hunt description: Hunt Computer-Use-Agent (CUA) prompt-injection surface — instructions planted in CUA-readable DOM channels (hidden text, aria-label, alt, noscript). Load when a target is consumed or driven by a Computer-Use Agent.

cua-hunt — Computer-Use-Agent injection surface

Load when target is consumed by a Computer-Use Agent (Claude CUA, OpenAI Operator, ChatGPT Atlas browser, Sider, Comet, Genspark) OR when victim users are likely to drive a CUA through the app.

Alternatives in Development

Domxss — Confirm DOM XSS in a real headless browser — injects canary payloads into params + URL fragment and only repor 4.5k ★
/hunt — Active vulnerability hunting on a target 1.8k ★
Label Issue 1.3k ★