account-takeover SKILL.md skillA
account-takeover from hellodqy/mastermind-bug-bounty is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add hellodqy/mastermind-bug-bounty/account-takeover@git:20260915.240c761Pins git:20260915.240c761 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- hellodqy/mastermind-bug-bounty
- Path
skills/account_takeover/SKILL.md- Versions recorded
- 2
- Latest version
- git:20260915.240c761, committed Sep 15, 2026
- First version recorded
- Sep 14, 2026
- Size
- 1,510 bytes
- Repository stars
- 14
- License
- none declared
Analyze login, recovery, verification, MFA, session refresh, and account binding flows when a weakness may let one user assume another identity.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Account Takeover ## Goal 判断认证生命周期中的身份、挑战、票据与账号绑定是否错位，并用测试账号证明最终登录身份发生了非预期变化。 ## Tools / Inputs - 登录/找回/验证码/MFA/换绑入口、测试账号、会话与票据、OAuth/OIDC 回调 - 需要隔离测试邮箱时路由到 `skills/mail_code/SKILL.md`，不要在认证 Skill 中预加载接码脚本 - 资源索引：`references/INDEX.md`；候选资源：`authentication-flow-testing.md`、`oauth-oidc-saml-testing.md` ## Constraints 1. 仅使用自有测试账号和可恢复的绑定信息。 2. 不注销、吊销或锁死现有会话，不改动真实用户凭据。 3. 验证码、票据或状态参数异常必须落到最终身份变化才算成立。 4. 优先做身份绑定差分，不做无意义口令喷洒。 5. 记录正常流与异常流的主体、受众、用途和生命周期差异。 ## Chain Questions - 当前挑战绑定的是账号、会话、设备、客户端还是一次具体动作？ - 回调、刷新、换绑后服务端认定的主体是谁？ - 是否能把攻击者控制的验证材料应用到另一个测试账号？ - 新身份能否进入敏感数据、管理操作或令牌链？
Read the whole file at its exact version.
How to install
mdr add hellodqy/mastermind-bug-bounty/account-takeover@sha256:59fee4f4861d9310The line at the top of this page pins the label git:20260915.240c761, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_u2c52mjl7dokpbuy)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Sep 14, 2026 and Sep 15, 2026, more than one a day.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260915.240c761 latest | 2026-09-15 | 240c761 | 1,510 B | A | view · diff |
| git:20260914.819e838 | 2026-09-14 | 819e838 | 1,394 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (1510 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
hellodqy/mastermind-bug-bounty · 14 stars · license none declared · pushed 2026-09-16 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_u2c52mjl7dokpbuy GET https://markdownregistry.com/api/v1/resolve?ref=hellodqy/mastermind-bug-bounty/account-takeover GET https://markdownregistry.com/api/v1/blob/59fee4f4861d9310e82effd1474dab87f58b0aeadab8ee317e7b758ac40c8ba7
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.