hunt-cache-poison

92 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53

Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception Armor bypass, session-token cache deception, Akamai hop-by-hop smuggling → server-side edge poisoning, and Kettle's 2024 path-normalization WCD against Cloudflare/Fastly/GCP. Host/X-Forwarded-Host injection that reaches app logic (reset-lin…

Works with any agent that supports SKILL.md skills.

What this skill can do

Sends data to these websites: target.com

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 11 places.

skills/hunt-cache-poison/SKILL.md, line 133curl -s -I "https://target.com/page" | grep -i "age\|x-cache\|cf-cache"
skills/hunt-cache-poison/SKILL.md, line 134curl -s -I "https://target.com/page" | grep -i "age\|x-cache\|cf-cache"
skills/hunt-cache-poison/SKILL.md, line 139curl -s -H "X-Forwarded-Host: evil.attacker.com" \

Show 8 more

skills/hunt-cache-poison/SKILL.md, line 146curl -s -b "session=YOUR_SESSION" \
skills/hunt-cache-poison/SKILL.md, line 150curl -s "https://target.com/account/profile.css"
skills/hunt-cache-poison/SKILL.md, line 158curl -s -H "X-Forwarded-Host: canary.attacker.com" \
skills/hunt-cache-poison/SKILL.md, line 164curl -s -H "X-Forwarded-Host: aaaaaaaaaaa.invalid" \
skills/hunt-cache-poison/SKILL.md, line 167curl -s -I "https://target.com/js/app.js" | grep "HTTP/"
skills/hunt-cache-poison/SKILL.md, line 188curl -s "https://target.com/page?cb=1&param=CANARY_VALUE" | grep CANARY_VALUE
skills/hunt-cache-poison/SKILL.md, line 190curl -s "https://target.com/page?cb=1"
skills/hunt-cache-poison/SKILL.md, line 210Add `Origin` to the unkeyed-header set. Test whether it is reflected into `Access-Control-Allow-Origin` and then cached: `curl -H "Origin: evil.example" URL -I`

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 6 places.

skills/hunt-cache-poison/SKILL.md, line 133curl -s -I "https://target.com/page" | grep -i "age\|x-cache\|cf-cache"
skills/hunt-cache-poison/SKILL.md, line 139curl -s -H "X-Forwarded-Host: evil.attacker.com" \
skills/hunt-cache-poison/SKILL.md, line 146curl -s -b "session=YOUR_SESSION" \

Show 3 more

skills/hunt-cache-poison/SKILL.md, line 158curl -s -H "X-Forwarded-Host: canary.attacker.com" \
skills/hunt-cache-poison/SKILL.md, line 164curl -s -H "X-Forwarded-Host: aaaaaaaaaaa.invalid" \
skills/hunt-cache-poison/SKILL.md, line 188curl -s "https://target.com/page?cb=1&param=CANARY_VALUE" | grep CANARY_VALUE

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'hunt-cache-poison' ] || [ -L ~/.agents/skills/'hunt-cache-poison' ]; then echo 'A skill folder named hunt-cache-poison already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/hunt-cache-poison' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/hunt-cache-poison' ~/.agents/skills/'hunt-cache-poison' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hunt-cache-poison' ~/.claude/skills/'hunt-cache-poison' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.

SkillTrust badge for elementalsouls/Claude-BugHunter

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/elementalsouls/Claude-BugHunter.svg)](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)

Score history

Date	Version	Score
2026-11-10	`d5dcc53`	92
2026-11-08	`42a3ab1`	92
2026-11-06	`3e71af0`	92