bypass-agent SKILL.md skillA
bypass-agent from hellodqy/mastermind-bug-bounty is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add hellodqy/mastermind-bug-bounty/bypass-agent@git:20260709.a882698Pins git:20260709.a882698 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- hellodqy/mastermind-bug-bounty
- Path
agents/bypass/SKILL.md- Versions recorded
- 2
- Latest version
- git:20260709.a882698, committed Jul 9, 2026
- First version recorded
- Jun 2, 2026
- Size
- 1,470 bytes
- Repository stars
- 14
- License
- none declared
Access-control bypass agent. Treat 401/403/405 as routing clues, not as final answers; connect bypasses to privilege escalation.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Bypass Agent ## Goal 把受阻访问转化为新的路径、新的方法、新身份或新的权限边界判断。 ## Tools / Inputs - 401/403/405 队列 - 路径、方法、Header、Host、Origin、Referer、JWT/OAuth 线索 - 已有 token、普通用户账号、泄露 key - `skills/auth_bypass/SKILL.md`、`skills/oauth_sso/SKILL.md` ## Constraints 1. WAF 绕过是最后手段；优先做低风险访问控制推理。 2. 成功绕过后必须验证拿到了什么新数据或新动作。 3. 失败也要记录原始状态、尝试角度和仍可能的下游方向。 4. 不为了绕过而绕过；绕过必须服务于更高影响证明。 5. 碰到 JWT/OAuth 线索时优先判断能否形成身份提升链。 ## Chain-First Loop 每遇到阻断都问： - 这是认证失败、授权失败、路由失败，还是方法/Content-Type 不匹配？ - 换路径/方法/Header 后是否进入了不同后端逻辑？ - 普通用户 token 能不能触达管理接口？ - 这个绕过能不能连接到导出、配置、任务执行、用户管理接口？ - 成功后是否足够进入 Verifier，还是继续往权限上游追？
Read the whole file at its exact version.
How to install
mdr add hellodqy/mastermind-bug-bounty/bypass-agent@sha256:d27a52d89d19e44bThe line at the top of this page pins the label git:20260709.a882698, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_i76bynpineb63rgc)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Jun 2, 2026 and Jul 9, 2026, about one every 37 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260709.a882698 latest | 2026-07-09 | a882698 | 1,470 B | A | view · diff |
| git:20260602.95e27a7 | 2026-06-02 | 95e27a7 | 4,633 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (1470 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
hellodqy/mastermind-bug-bounty · 14 stars · license none declared · pushed 2026-09-16 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_i76bynpineb63rgc GET https://markdownregistry.com/api/v1/resolve?ref=hellodqy/mastermind-bug-bounty/bypass-agent GET https://markdownregistry.com/api/v1/blob/d27a52d89d19e44b3ab7a1e1ef18d04fb17adbde2d7f5ed7aba92a1e5187532c
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.