The Agent Skills Directory

[SAFE]: The skill serves as an educational and methodological guide for bug bounty hunters and security professionals focusing on OAuth and OIDC vulnerabilities.
[COMMAND_EXECUTION]: The skill provides numerous examples of shell commands using curl, grep, jq, and adb. These are standard utilities used in the context of the primary task (security research) and are presented as reference templates for the user.
[REMOTE_CODE_EXECUTION]: An automated detection flagged a command involving curl piped to python3 as a high-risk remote code execution pattern. However, manual review confirms this is a false positive. The full command curl https://target.com/.well-known/openid-configuration | python3 -m json.tool utilizes the -m json.tool flag, which invokes a standard Python library for pretty-printing JSON data. It does not execute the downloaded content as code.
[DATA_EXFILTRATION]: While the skill describes techniques for capturing OAuth tokens and authorization codes (e.g., via Referer headers or open redirects), these descriptions are provided within a vulnerability research context. The skill does not contain logic to exfiltrate the user's local data or credentials.

hunt-oauth