ffuf_claude_skill

Run `npx skills add jthack/ffuf_claude_skill --all -g -y` in your terminal to install the skill globally. You also need ffuf installed on your system, for example via `brew install ffuf` on macOS.

It lets your agent run ffuf web fuzzing from plain-English requests, finding hidden directories, files, subdomains, parameters, and API endpoints on authorized targets.

Yes. You save a full authenticated HTTP request to a req.txt file with the FUZZ keyword, and the skill runs ffuf against it with your cookies, tokens, or API keys intact.

It enforces ffuf auto-calibration (-ac) on every scan and includes a helper script that analyzes JSON results to surface anomalous status codes, sizes, and interesting paths.

Only on systems you own or have explicit written permission to test. Unauthorized fuzzing is illegal, and the skill includes rate limiting defaults to avoid disrupting target services.