hellodqy/mastermind-bug-bounty/data-linkage
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Connect response values to later request parameters and keep expanding the attack graph after each finding.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/data-linkageSKILL.md
Data Linkage
Goal
把“一个响应里出现的值”变成“另一个接口的输入”，持续扩大攻击面。
Tools / Inputs
_endpoint_params.json_leaked_values.json- Response mining、PairingEngine、method fallback
- 资源索引：
references/INDEX.md；候选资源：response-chaining.md、discovery-amplification.md
Constraints
- 每个有意义响应都要提取字段和值。
- 高价值值优先：token、ID、key、role、org、tenant、email、phone。
- 每次值池增长后重新检查可注入接口。
- 已消费/未消费状态必须记录。
- 不把单次命中当终点；命中后继续看它打开了什么新门。
Chain Questions
- 这个值能喂给哪些参数名相同或语义相近的接口？
- 它能否扩大查询范围、越权范围或角色权限？
- 新响应是否产生了新的 token、ID、key 或路径？
- 三轮无新增价值后是否该换方向？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/data_linkage/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/data-linkage)