hellodqy/mastermind-bug-bounty/cache-poisoning
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Analyze cache key confusion as a path to stored impact.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/cache-poisoningSKILL.md
Cache Poisoning
Goal
判断未进入 cache key 的 Header/参数是否能改变缓存响应，并产生可验证的持久影响。
Tools / Inputs
- CDN/cache headers、Host/X-Forwarded-*、query params、static/dynamic responses
- 资源索引：
references/INDEX.md；候选资源：cache-poisoning-testing.md；仅在已确认过滤差异时再读bypass_techniques.md
Constraints
- 不向生产用户投递恶意内容。
- 使用自控无害标记证明污染。
- 必须证明缓存命中和跨请求可见。
- 不把 header reflection 单独当漏洞。
- 成功后追问 XSS、redirect、credential leakage、DoS 风险。
Chain Questions
- 哪些输入影响响应但不影响 cache key？
- 污染是否可被其他用户命中？
- 影响能否升级为脚本执行、跳转、敏感信息暴露？
- 是否存在更安全的证明方式？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/cache_poisoning/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/cache-poisoning)