Web Cache Poisoning detection and exploitation. Covers unkeyed headers, parameter cloaking, cache key normalization, XSS via cache, and DoS via cache. Targets: CDN (Cloudflare/Akamai/Fastly), reverse proxy (Varnish/Nginx), application-level caching (Redis/Memcached).
SkillScore82Maintained
Automatic
◆Security & AppSec pack
Last verified 8/4/2026
What it changes
Passed 18 of 22 test cases with the skill, and 15 of 22 without it.
Without skill68%
With skill82%
Checks it passed that the model alone missed
Includes X-Forwarded-Host in the list of candidate headers.
Restricts header injection testing strictly to self-owned canary values.
Identifies Fat GET as the technique of sending parameters in the GET request body.
3 fixed15 passed either way4 still failing0 broke
Pass-rate lift
+14 pp
Tokens
+80%
Agent turns
0%
Response time
-26%
Model gemini-3.6-flashMeasured 8/4/2026v118 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
What safety standard must be followed when choosing values for header injection during automated cache behavior testing?
What was checked, without and with the skill
Checked
Without skill
With skill
Restricts header injection testing strictly to self-owned canary values.
Missed
Passed
case-17 · gemini-3.6-flash · 8/4/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md235 linessingle file
Web Cache Poisoning — Detection & Exploitation
Cache Poisoning turns a single crafted request into a persistent attack
that affects every subsequent user requesting the same resource.
1. Cache Identification
Response Headers
Cache Hit Indicators:
X-Cache: HIT / hit / Hit from cloudfront
X-Cache-Status: HIT
CF-Cache-Status: HIT
Age: > 0
X-Served-By: cache-*
X-Cache-Hits: 1+
Cache Providers:
Cloudflare: CF-Cache-Status, CF-RAY
AWS CloudFront: X-Cache, Via: ...cloudfront...
Akamai: X-Cache, X-Cache-Key
Fastly: X-Served-By, X-Cache-Hits
Varnish: X-Varnish, Via: varnish
Nginx: X-Proxy-Cache
Cache Key Detection
The cache key is what the cache uses to identify "same resource". Only
unkeyed components can be poisoned.
Step 1: Baseline request
GET /?cb=1234 HTTP/1.1
Host: target.com
Step 2: Add suspect header
GET /?cb=1235 HTTP/1.1
Host: target.com