hunt-cache-poison

Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception Armor bypass, session-token cache deception, Akamai hop-by-hop smuggling → server-side edge poisoning, and Kettle's 2024 path-normalization WCD against Cloudflare/Fastly/GCP. Host/X-Forwarded-Host injection that reaches app logic (reset-link poisoning, routing SSRF, OAuth issuer) is owned by hunt-host-header; this skill owns the case where the poisoned response is CACHED and served to other users. Use when hunting cache poisoning, Web Cache Deception, CDN-fronted apps.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, actionable hunting skill with concrete commands and a well-validated workflow. Its main weaknesses are verbosity in the narrative example/citation sections and a monolithic structure that could benefit from splitting reference material into separate files.

Suggestions

Tighten the 'Real Impact Examples' scenarios into concise one-line summaries (target + attack + impact) instead of multi-sentence narratives to recover token budget.

Move the 'Disclosed Report Citations' and 'Bypass Techniques' sections into reference files (e.g. references/CITATIONS.md, references/BYPASSES.md) and keep SKILL.md as an overview with one-level-deep pointers.

Consider extracting the unkeyed-header wordlist and WCD path-extension list into a scripts/ or references/ asset so the main body stays lean.

Dimension	Reasoning	Score
Conciseness	The body is dense and assumes Claude's competence (it never explains what a cache or XSS is), but the 'Real Impact Examples' and 'Disclosed Report Citations' sections are lengthy narrative prose that could be tightened without losing value.	3 / 5
Actionability	Provides fully executable guidance — copy-paste curl commands, an exact unkeyed-header Burp Intruder wordlist, grep patterns, and concrete cache-busting tactics like '?cb=$RANDOM' covering the common cases.	5 / 5
Workflow Clarity	A 10-step hunting methodology is clearly sequenced, and the Gate 0 Validation section adds explicit checkpoints (reproduce from a 'separate, unauthenticated request ... from a different client/IP') with feedback loops for error recovery.	5 / 5
Progressive Disclosure	Sections are well-organized with clear headers, but the file is monolithic with no bundle files — the large 'Disclosed Report Citations', 'Real Impact Examples', and 'Bypass Techniques' content is inlined where it could be split into one-level-deep reference files.	3 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A high-quality description that names concrete attack subclasses, gives explicit when-to-use triggers, and clearly boundaries itself against the related hunt-host-header skill. Slightly more trigger-term synonym coverage would push it to a perfect score.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete attack subclasses — 'X-Forwarded-Host poisoning', 'X-HTTP-Method-Override / GCS cache', 'reflected→stored XSS via cache', 'Cloudflare Cache Deception Armor bypass', 'Akamai hop-by-hop smuggling → server-side edge poisoning', 'Kettle's 2024 path-normalization WCD' — giving comprehensive coverage of capabilities.	5 / 5
Completeness	Explicitly answers both 'what' ('Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including...') and 'when' ('Use when hunting cache poisoning, Web Cache Deception, CDN-fronted apps.') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural phrases a user would say ('cache poisoning', 'Web Cache Deception', 'CDN-fronted apps'), but is missing some common synonyms and concrete file/tech extensions that would round out coverage.	4 / 5
Distinctiveness Conflict Risk	Explicitly demarcates the niche from a sibling skill ('Host/X-Forwarded-Host injection that reaches app logic ... is owned by hunt-host-header; this skill owns the case where the poisoned response is CACHED and served to other users'), giving minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-cache-poison/SKILL.md
Commit: 58017df

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.