hellodqy/mastermind-bug-bounty/account-takeover
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Analyze login, recovery, verification, MFA, session refresh, and account binding flows when a weakness may let one user assume another identity.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/account-takeoverSKILL.md
Account Takeover
Goal
判断认证生命周期中的身份、挑战、票据与账号绑定是否错位，并用测试账号证明最终登录身份发生了非预期变化。
Tools / Inputs
- 登录/找回/验证码/MFA/换绑入口、测试账号、会话与票据、OAuth/OIDC 回调
- 需要隔离测试邮箱时路由到
skills/mail_code/SKILL.md，不要在认证 Skill 中预加载接码脚本 - 资源索引：
references/INDEX.md；候选资源：authentication-flow-testing.md、oauth-oidc-saml-testing.md
Constraints
- 仅使用自有测试账号和可恢复的绑定信息。
- 不注销、吊销或锁死现有会话，不改动真实用户凭据。
- 验证码、票据或状态参数异常必须落到最终身份变化才算成立。
- 优先做身份绑定差分，不做无意义口令喷洒。
- 记录正常流与异常流的主体、受众、用途和生命周期差异。
Chain Questions
- 当前挑战绑定的是账号、会话、设备、客户端还是一次具体动作？
- 回调、刷新、换绑后服务端认定的主体是谁？
- 是否能把攻击者控制的验证材料应用到另一个测试账号？
- 新身份能否进入敏感数据、管理操作或令牌链？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/account_takeover/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/account-takeover)