Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add SecurityTalent/bugskill-ai --skill otp-bruteforce-testinggit clone --depth 1 https://github.com/SecurityTalent/bugskill-aiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/securitytalent/bugskill-ai/otp-bruteforce-testing)<a href="https://agentmods.dev/skills/securitytalent/bugskill-ai/otp-bruteforce-testing"><img src="https://agentmods.dev/badge/skills/securitytalent/bugskill-ai/otp-bruteforce-testing.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00103 | $0.01948 |
| Opus 5 | $0.00051 | $0.00974 |
| Sonnet 5 | $0.00021 | $0.00390 |
| Haiku 4.5 | $0.00010 | $0.00195 |
Grade A, and why
otp-bruteforce-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OTP Brute-Force Testing
Validate whether an OTP verification endpoint can be brute-forced: unlimited attempts, no lockout, long TTL, weak entropy, or a response oracle that reveals the correct code. Targets must be within the scope of the engagement you are authorized to test.
When to use
- Phone/email verification flows (e.g., "add phone number to profile")
- MFA / 2FA challenge steps and login-by-OTP
- Password reset and account recovery
- Transaction confirmation (payments, withdrawals, admin actions)
- Any endpoint that accepts a 4-8 digit numeric code and returns success/failure
Core attack pattern (reference: HackerOne #3265780, CoinMate.io)
- Trigger an OTP challenge, submit any code, and intercept the verification request (Burp proxy).
- Brute-force the OTP space (100000–999999) with Burp Intruder or the bundled script.
- Detect the valid OTP via a response oracle — in the CoinMate case, the response containing a valid OTP had a Content-Length of 961 bytes vs. ~150 for failures.
- Replay the original intercepted request with the recovered OTP to complete the operation (the phone number is added to the profile).
- Chain the impact: attacker-controlled phone number on the account → the number receives login/reset OTPs → account takeover.
Phase 0 — Recon the OTP flow
- Map all OTP-issuing and OTP-verifying endpoints; note parameter names
(
otp,code,token,verificationCode), length (4/6/8 digits), format. - Check whether the code is ever returned in responses, logs, or debug headers.
- Check OTP entropy: sequential, timestamp-derived, or weak-PRNG codes have a much smaller candidate space than the nominal digit range.
- Note whether the same OTP is reusable across accounts or across flows (verify vs. reset vs. login).
Phase 1 — Baseline and response-oracle discovery
Send 10–20 wrong OTPs plus 1 valid OTP and diff the responses. Use the script's probe mode to inspect a single attempt:
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 153 lines · 103 tokens per session scan A f662d38517b3
otp-bruteforce-testing is a skill published in the GitHub repository SecurityTalent/bugskill-ai (6 stars, last pushed 22d ago), licensed MIT. It adds 103 tokens to every session and 1,948 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
playwright-best-practices
Use when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, testing accessibility (axe-core), file uploads/downloads, date/time mocking, WebSockets, geolocation, permissions…
bun-cli
Bun CLI reference for package management, script running, testing, bundling, and compilation. Covers bun install/add/remove/update, bun run, bun test, bun build, bunx, bun patch, bun audit fix, bun dedupe, bun prune, bun why, bun pm, bun repl, bunfig.toml, bun.lock, workspace catalogs, isolated installs and the global…
dev-discipline
Use when implementation work starts on a feature or bug fix: writing or modifying source code, adding tests, or closing out a branch. Covers TDD-first, scope integrity, secret and security hygiene, dual post-implementation review (code reviewer plus spec reviewer), and finish-branch closure. Triggers on "implement"…
rag-evaluator
Generates tailored giskard.checks evaluation suites for RAG (Retrieval-Augmented Generation) systems. Use whenever a user describes a Q&A bot grounded in documents, a knowledge-base chatbot, a retrieval system, or wants to evaluate answer groundedness, faithfulness, hallucination, retrieval quality, citation accuracy…
scenario-generator
Generates tailored giskard.checks test scenarios and suites for AI agents. Use when user describes their agent and fears, asks to "create scenarios", "test my agent", "generate checks", "evaluate my chatbot", "red-team my AI", or wants to build adversarial test cases for LLM-based applications.
edge-case-hunter
Focuses specifically on unusual inputs, boundary conditions, empty states, and unexpected user behavior that implementations commonly miss. Use to find what a normal test pass would skip over.