hellodqy/mastermind-bug-bounty/websocket-test
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Explore WebSocket state, authentication, subscriptions, and replay as chained attack surfaces.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/websocket-testSKILL.md
WebSocket Test
Goal
判断 WebSocket 是否在握手、消息、订阅、重放或 Origin 校验中暴露越权能力。
Tools / Inputs
- WS/WSS URL、Socket.IO/STOMP hints、tokens、room/channel/user IDs
- 资源索引：
references/INDEX.md；候选资源：websocket-security-testing.md；跨协议链路再读decision-trees.md
Constraints
- 不做连接耗尽或破坏性 DoS。
- 用测试账号验证跨用户订阅或消息动作。
- 每条消息都关注 userId、roomId、tenantId、role 等可控字段。
- 成功后证明实际接收或执行了不该发生的事件。
- 新 ID/channel/token 回写值池。
Chain Questions
- 认证发生在握手还是消息体？
- 换 token 或 userId 后订阅边界是否变化？
- 消息是否可重放、篡改或跨房间发送？
- WS 泄露的数据能否反哺 HTTP API？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/websocket_test/SKILL.md
Popularity
- Repository stars
- 14
- Repository forks
- 1
- 7-day trend score
- 19
Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/websocket-test)