autonomous-attacker SKILL.md skillA
autonomous-attacker from hellodqy/mastermind-bug-bounty is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add hellodqy/mastermind-bug-bounty/autonomous-attacker@git:20260711.c1d38baPins git:20260711.c1d38ba in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- hellodqy/mastermind-bug-bounty
- Path
agents/attacker/SKILL.md- Versions recorded
- 2
- Latest version
- git:20260711.c1d38ba, committed Jul 11, 2026
- First version recorded
- Jul 11, 2026
- Size
- 1,438 bytes
- Repository stars
- 14
- License
- none declared
Test ranked attack surfaces autonomously, preserve evidence, and turn new access into additional attack-chain hypotheses.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Autonomous Attacker ## Goal 按优先级验证攻击面，并在每次结果后自主决定补证、换方向或沿攻击链继续深入。 ## Tools / Inputs - `_attack_surfaces.json` - 已授权测试工具与确定性 Python helpers - `references/INDEX.md`，仅按当前假设加载相关资源 ## Constraints 1. 只在明确授权范围内测试。 2. `confidence < 0.4` 换方向，`0.4 <= confidence < 0.8` 补证，`confidence >= 0.8` 进入验证。 3. 记录请求、响应、影响、复现步骤和负结果。 4. 新资产、新权限或新数据必须重新评分并加入队列。 5. API 凭据必须证明可访问敏感数据/操作；Swagger、Druid、内网路径必须绕过并取得敏感结果，否则不得进入已验证候选。 ## Chain-First Questions - 当前发现提供了什么新的身份、数据、配置或执行能力？ - 能否从当前权限再提升一级？ - 继续深挖的预期价值是否仍高于队列中的下一个方向？ - 泄露凭据属于哪个 API，放在哪个 Header/参数，能调用哪些敏感接口？ - 暴露路径是否存在前缀、认证、方法、Header、反向代理或路由绕过？
Read the whole file at its exact version.
How to install
mdr add hellodqy/mastermind-bug-bounty/autonomous-attacker@sha256:c4f6f661eb7bb945The line at the top of this page pins the label git:20260711.c1d38ba, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_qfni2g7gj2mk24rj)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, all committed on Jul 11, 2026.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260711.c1d38ba latest | 2026-07-11 | c1d38ba | 1,438 B | A | view · diff |
| git:20260711.d202fe9 | 2026-07-11 | d202fe9 | 1,172 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (1438 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
hellodqy/mastermind-bug-bounty · 14 stars · license none declared · pushed 2026-09-16 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_qfni2g7gj2mk24rj GET https://markdownregistry.com/api/v1/resolve?ref=hellodqy/mastermind-bug-bounty/autonomous-attacker GET https://markdownregistry.com/api/v1/blob/c4f6f661eb7bb945373d5818caf760d8b810400fedc878ce6f703afbab0b78aa
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.