A security-testing workflow for finding serious weaknesses such as unauthorized access, code execution, data leaks, and supply-chain attacks.

Use it to investigate zero-days, backdoors, authentication bypasses, exposed secrets, cloud misconfigurations, race conditions, and related attack chains.

It requires direct evidence and checks how separate weaknesses can combine, helping avoid unsupported or incomplete vulnerability claims.

zerodayhunt — Skill for Claude Code by kalpmodi

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add kalpmodi/akira --skill zerodayhunt

Clone the repo

git clone --depth 1 https://github.com/kalpmodi/akira

Made for: Claude Code.

Or install akira, the plugin that ships this one along with the rest of its 16 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/kalpmodi/akira/zerodayhunt/github.svg)](https://agentmods.dev/skills/kalpmodi/akira/zerodayhunt)

Your own site

<a href="https://agentmods.dev/skills/kalpmodi/akira/zerodayhunt"><img src="https://agentmods.dev/badge/skills/kalpmodi/akira/zerodayhunt/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/kalpmodi/akira/zerodayhunt"><img src="https://agentmods.dev/badge/skills/kalpmodi/akira/zerodayhunt.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 136 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,718 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00136	$0.02718
Opus 5	$0.00068	$0.01359
Sonnet 5	$0.00027	$0.00544
Haiku 4.5	$0.00014	$0.00272

Measured 11d ago against content hash 795a4fc0b612, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

zerodayhunt scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/zerodayhunt/SKILL.md · 180 lines

How it starts

The opening of the file, as written. The whole thing — 180 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Zero-Day & Critical Vulnerability Hunt

Philosophy

Automated tools find known CVEs. This skill finds what scanners miss: logic flaws, architecture leaks, supply chain vectors, auth bypasses, and chained attacks. Evidence required before claiming ANY finding. Never hallucinate - if you didn't see it in a response body, it didn't happen.

The rule that separates elite from script kiddie: A single finding is rarely Critical. The payout comes from CHAINING. SSRF + AWS metadata = IAM creds = cloud takeover. Info disclosure + IDOR = mass PII = Critical. Always ask: "What can I do WITH this?"

Critical rule: NEVER stop at "SSRF/network reachability possible" or "endpoint exists". Must prove full chain: credentials extracted, PII accessed, or data exfiltrated. A 200 with empty body = WAF catch-all, not a real finding.

ARGUMENTS

<target> - domain (e.g. target.com) <focus> - optional: RCE / SSRF / IDOR / SUPPLY-CHAIN / JWT / BUSINESS-LOGIC / CHAIN / ALL

Phase 0: Smart Intake

source ~/.claude/skills/_shared/phase0.sh
source ~/.claude/skills/_shared/signals.sh
p0_init_vars "$1"
p0_state_gate "HARVEST" || exit 0
p0_read_relay recon secrets exploit
p0_read_memory
p0_read_hypotheses

# Aliases for downstream phase references
TECH_STACK=$KNOWN_TECH
ALL_ENDPOINTS="$INTERESTING_ENDPOINTS $WAYBACK_ENDPOINTS $API_SPEC_ENDPOINTS"
ATW_FLAGGED=$(echo "$ATW_FLAGGED" 2>/dev/null)

echo "=== ZERODAYHUNT SMART INTAKE: $TARGET ==="
echo "State: $STATE | WAF: $WAF | Tech: $TECH_STACK"
echo "Top hypothesis: $TOP_HYPO_LABEL [$TOP_HYPO_PROB%]"
echo "SSRF vectors from exploit: $(echo "$SSRF_VECTORS" | wc -l)"
echo "Internal IPs available: $(echo "$INTERNAL_IPS" | wc -w)"
echo "JWT tokens: $(echo "$JWT_TOKENS" | wc -l)"
echo "Prior confirmed findings: $(echo "$CONFIRMED_VULNS" | wc -l)"
echo "ATW flagged (skip): $ATW_FLAGGED"
echo ""
echo "Phase selection - run phases where we have targets:"
[ -n "$SSRF_VECTORS" ] && echo "  Phase 8 (SSRF): YES - $(echo "$SSRF_VECTORS" | wc -l) vectors to chain"
[ -n "$JWT_TOKENS" ] && echo "  Phase 7 (JWT): YES - tokens found"
[ -n "$INTERNAL_IPS" ] && echo "  Phase 8 (SSRF pivot): YES - internal IPs to target"
[ -n "$CONFIRMED_VULNS" ] && echo "  Phase 23 (Chain): YES - $(echo "$CONFIRMED_VULNS" | wc -l) confirmed to chain"

Read the full file on GitHub · 180 lines

Files

What ships with it

20 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

11d ago First seen · 180 lines · 136 tokens per session scan A 795a4fc0b612

Subscribe to this mod's changes

zerodayhunt is a skill published in the GitHub repository kalpmodi/akira (21 stars, last pushed 2mo ago), licensed MIT. It adds 136 tokens to every session and 2,718 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Claude Code LLM Security bug-bounty ctf hacking offensive-security

performing-aws-privilege-escalation-assessment

Performing authorized privilege escalation assessments in AWS environments to identify IAM misconfigurations that allow users or roles to elevate their permissions using Pacu, CloudFox, Principal Mapper, and manual IAM policy analysis techniques.

xalgorix/xalgorix · 54 tokens

hunt-llm-ai

Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration viatool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection via documents/web pages/email the model reads, ASCII smuggling…

uphiago/recon-skills · 256 tokens

performing-cloud-penetration-testing-with-pacu

Performing authorized AWS penetration testing using Pacu, the open-source AWS exploitation framework, to enumerate IAM configurations, discover privilege escalation paths, test credential harvesting, and validate security controls through systematic attack simulation.

xalgorix/xalgorix · 51 tokens

conducting-cloud-penetration-testing

This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understanding the shared responsibility model for testing scope, leveraging cloud-specific attack tools like Pacu and ScoutSuite, exploiting IAM misconfigurations, testing for SSRF…

xalgorix/xalgorix · 79 tokens

performing-kubernetes-penetration-testing

Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools.

xalgorix/xalgorix · 46 tokens

conducting-full-scope-red-team-engagement

Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities.

26zl/cybersec-toolkit · 44 tokens