Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Built on public Host-header research (PortSwigger 'Practical web cache poisoning' + James Kettle, and the classic password-reset-poisoning class). Use on any forgot-password flow, CDN/reverse-proxy-fronted app, OAuth/OIDC endpoint, or absolute-URL-in-email feature.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
ajtazer/heckit☆ 22026년 10월 7일 업데이트
Undo a haircut trim. Puts back the skills, commands, subagents, MCP servers, hooks, plugins and files that haircut parked into a dated bag, using the receipt it wrote at the time. Use this skill whenever the user says undo the cleanup, undo the haircut, put my config back, restore what was trimmed, I need that MCP server again, that skill is gone and I want it back, roll the trim back, what is in the bag, or which files were moved. Use it also when something stopped working right after a config cleanup and they suspect the cleanup caused it, and whenever they ask how to reverse a config cleanup they regret.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
OthmanAdi/haircut☆ 22026년 9월 14일 업데이트