hellodqy/mastermind-bug-bounty/http-smuggling

Claude Code and agent skill by hellodqy/mastermind-bug-bounty

Trust tier 3
  • community
Source check pending

Checking that the SKILL.md file is still in the repository.

Consider request smuggling only when architecture hints make it relevant, and connect confirmation to downstream impact.

Install

npx vskill@latest install hellodqy/mastermind-bug-bounty/http-smuggling

SKILL.md

HTTP Smuggling

Goal

判断前后端解析差异是否能绕过 WAF、劫持请求、污染缓存或影响其他用户请求。

Tools / Inputs

  • Proxy/CDN/WAF headers、HTTP/1.1 support、keep-alive behavior、edge/backend hints
  • 资源索引：references/INDEX.md；候选资源：http-request-smuggling.md；需要既有 WAF 假设时再读 bypass_techniques.md

Constraints

  1. 只在有代理/网关架构线索时测试。
  2. 使用无害探针，不影响其他用户。
  3. 单纯延迟异常不是报告结论，必须连接到影响。
  4. 成功后优先追问 WAF bypass、cache poisoning、credential hijack。
  5. 有生产风险时停止并记录 PENDING。

Chain Questions

  • 前端和后端是否解析不同？
  • 是否能让后端看到前端没看到的请求？
  • 能否绕过访问控制或污染缓存？
  • 是否值得继续还是应保守报告风险？

Security

  • Security scanPassed, 90 of 100Pattern checks on the skill's files.
  • Model reviewPassed

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

7-day trend score
5

Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/hellodqy/mastermind-bug-bounty/http-smuggling/badge)](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/http-smuggling)

Something wrong with this skill or its page? Tell us.