injection-test SKILL.md skillA
injection-test from hellodqy/mastermind-bug-bounty is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add hellodqy/mastermind-bug-bounty/injection-test@git:20260914.819e838Pins git:20260914.819e838 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- hellodqy/mastermind-bug-bounty
- Path
skills/injection_test/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260914.819e838, committed Sep 14, 2026
- Size
- 1,315 bytes
- Repository stars
- 14
- License
- none declared
Test parser and interpreter boundaries when user-controlled values reach database queries, templates, commands, expressions, headers, or downstream protocols.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Injection Test ## Goal 依据参数语义、技术栈和响应差分选择解释器假设，并把最小执行证据连接到数据、权限或代码执行影响。 ## Tools / Inputs - 参数、Content-Type、错误/布尔/时间差分、技术栈、模板与命令上下文 - 资源索引：`references/INDEX.md`；候选资源：`injection-testing.md`、`api-fuzz-payloads.md` ## Constraints 1. 先确认输入进入哪个解释器，不对所有参数喷洒同一 payload。 2. 优先无副作用的错误、布尔或可控标记证明。 3. 时间差必须有重复基线和对照组。 4. 不读取无关数据、不执行破坏性命令。 5. 只有稳定、可复现且具实际影响的结果才进入 verifier。 ## Chain Questions - 输入经过哪些解码、拼接、类型转换和二次解析？ - 同一字段换位置或 Content-Type 是否进入不同处理器？ - 能否从语法控制升级到认证绕过、数据访问、文件读取或执行？ - 哪个最小对照最能排除缓存、WAF 和网络抖动？
Read the whole file at its exact version.
How to install
mdr add hellodqy/mastermind-bug-bounty/injection-test@sha256:75e95e625baa9b6dThe line at the top of this page pins the label git:20260914.819e838, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_mxviogk3do37by4m)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 14, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (1315 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
hellodqy/mastermind-bug-bounty · 14 stars · license none declared · pushed 2026-09-16 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_mxviogk3do37by4m GET https://markdownregistry.com/api/v1/resolve?ref=hellodqy/mastermind-bug-bounty/injection-test GET https://markdownregistry.com/api/v1/blob/75e95e625baa9b6d1172764d8917f102b332a6d51870e790244bd92051175add
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.