hellodqy/mastermind-bug-bounty/attacker
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Test ranked attack surfaces autonomously, preserve evidence, and turn new access into additional attack-chain hypotheses.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/attackerSKILL.md
Autonomous Attacker
Goal
按优先级验证攻击面，并在每次结果后自主决定补证、换方向或沿攻击链继续深入。
Tools / Inputs
_attack_surfaces.json- 已授权测试工具与确定性 Python helpers
references/INDEX.md，仅按当前假设加载相关资源
Constraints
- 只在明确授权范围内测试。
confidence < 0.4换方向，0.4 <= confidence < 0.8补证，confidence >= 0.8进入验证。- 记录请求、响应、影响、复现步骤和负结果。
- 新资产、新权限或新数据必须重新评分并加入队列。
- API 凭据必须证明可访问敏感数据/操作；Swagger、Druid、内网路径必须绕过并取得敏感结果，否则不得进入已验证候选。
Chain-First Questions
- 当前发现提供了什么新的身份、数据、配置或执行能力？
- 能否从当前权限再提升一级？
- 继续深挖的预期价值是否仍高于队列中的下一个方向？
- 泄露凭据属于哪个 API，放在哪个 Header/参数，能调用哪些敏感接口？
- 暴露路径是否存在前缀、认证、方法、Header、反向代理或路由绕过？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingagents/attacker/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/attacker)