hunt-ssrf (Claude-BugHunter) — agentic threat model

Not certain from the listing — relies on underlying LLMs (likely Claude given the name) which are susceptible to jailbreaks or prompt injection that could bypass safety filters to target unauthorized, non-consenting networks.

Utilizes a specialized dataset of 15 disclosed SSRF reports and patterns. If this local knowledge base is poisoned or manipulated, the agent could be tricked into generating benign payloads or sending exfiltration data to malicious third-party OOB servers.

Orchestrates multi-step SSRF chains (e.g., DNS rebinding, gopher-to-Redis). Vulnerable to tool misuse or insecure tool integration if the framework executing these payloads does not strictly validate target inputs, potentially allowing local file inclusion or command injection on the runner.

Not certain from the listing — the hosting environment requires strict outbound network controls. If the agent runner is not sandboxed, executing SSRF payloads locally could result in loopback exploitation or local cloud metadata compromise of the runner's own host.

Features a mandatory out-of-band (OOB) Collaborator confirmation mechanism for blind SSRF to verify findings, which acts as a built-in validation guardrail to prevent false positives and track payload execution.

Not certain from the listing — lacks explicit authorization, scoping, or consent verification mechanisms in the description to ensure the offensive payloads are only launched against legally approved targets.

Designed as an offensive 'skill' or sub-agent. If integrated into a larger multi-agent pentesting framework, a compromise or malicious instruction from a coordinator agent could weaponize this skill against unauthorized infrastructure.