What problem does it solve? Web cache poisoning testing is risky and often inconclusive: testers struggle to prove that a CDN, reverse proxy, or application cache actually reuses a response variant keyed incorrectly, without polluting shared caches or affecting other users. This Skill provides an evidence-gated, safety-first procedure for verifying cache key and response variant flaws on authorized targets. ## Core Features & Use Cases - Trigger Signal Detection: Identifies cacheable responses via X-Cache, Age, Vary, Cache-Control headers, URL rewriting, and unkeyed input parameters. - Safe Validation Protocol: Establishes MISS-to-HIT baselines, then injects harmless, self-identifiable markers one variable at a time, comparing results across two isolated browser profiles. - Strict Oracle and Stop Conditions: Distinguishes real cache reuse from reflection, browser caching, or personalization, and mandates stopping when shared objects, uncontrollable TTLs, or cross-user impact is detected. - Use Case: During an authorized assessment, you notice a CDN fronted site reflects a query parameter that is not part of the cache key. Use this Skill to prove whether a controlled marker is served to a second clean profile from cache, with full header and timeline evidence. ## Quick Start Ask the agent to run the hunt-cache-poison procedure against an authorized in-scope target to test whether unkeyed inputs produce cached response variants.
