hellodqy/mastermind-bug-bounty/injection-test
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Test parser and interpreter boundaries when user-controlled values reach database queries, templates, commands, expressions, headers, or downstream protocols.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/injection-testSKILL.md
Injection Test
Goal
依据参数语义、技术栈和响应差分选择解释器假设，并把最小执行证据连接到数据、权限或代码执行影响。
Tools / Inputs
- 参数、Content-Type、错误/布尔/时间差分、技术栈、模板与命令上下文
- 资源索引：
references/INDEX.md；候选资源：injection-testing.md、api-fuzz-payloads.md
Constraints
- 先确认输入进入哪个解释器，不对所有参数喷洒同一 payload。
- 优先无副作用的错误、布尔或可控标记证明。
- 时间差必须有重复基线和对照组。
- 不读取无关数据、不执行破坏性命令。
- 只有稳定、可复现且具实际影响的结果才进入 verifier。
Chain Questions
- 输入经过哪些解码、拼接、类型转换和二次解析？
- 同一字段换位置或 Content-Type 是否进入不同处理器？
- 能否从语法控制升级到认证绕过、数据访问、文件读取或执行？
- 哪个最小对照最能排除缓存、WAF 和网络抖动？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/injection_test/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/injection-test)