hellodqy/mastermind-bug-bounty/ai-security
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Treat AI systems as chains of prompt, retrieval, memory, tools, and permissions.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/ai-securitySKILL.md
AI Security
Goal
判断用户或外部内容能否影响 AI 的数据访问、工具调用、记忆、检索结果或后端动作。
Tools / Inputs
- Chat/RAG/Agent/MCP/tool-call/code-sandbox surfaces
- 资源索引：
references/INDEX.md；候选资源：ai-security-testing.md、ai-security-vulnforge.md；云 IDE/编程台另读ai-development-platforms.md
Constraints
- Prompt injection 本身不是漏洞，必须证明越权影响。
- 工具调用 abuse 用无害动作证明。
- 区分模型输出污染、数据泄露和实际后端动作。
- 间接注入必须证明被检索或执行。
- 新 token/key/file/path 回注传统 Web 攻击面。
Chain Questions
- 输入能否控制工具参数或检索上下文？
- 是否能读取系统提示、其他用户数据、内部文档或凭据？
- AI 动作能否触发 Web/API 层漏洞？
- 当前影响是否可验证？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/ai_security/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/ai-security)