How to use the HTTP Parameter Pollution agent skill

What the skill makes the agent do

Once the skill is active, the agent works through an HPP methodology as an operational checklist. The source describes it as a methodology guide for security testing rather than a tool that attacks anything by itself. The agent explains how each technology resolves duplicate parameters, suggests test requests for URLs, forms, JSON, cookies, GraphQL and WebSockets, and discusses how such inconsistencies can bypass web application firewalls.

The skill's instructions tell the agent to follow steps in order unless you specify otherwise, consider each technique against the current target, track which checklist items are complete, and suggest next steps based on findings.

• Explains duplicate-parameter behaviour for ASP.NET/IIS, PHP/Apache, JSP/Tomcat, Perl CGI, Python/Flask and Node.js/Express, as listed in the source
• Suggests test requests for URL, form, hybrid, JSON, cookie, GraphQL, WebSocket and array-notation pollution
• Covers parameter cloaking with encoding and case variations
• Discusses WAF bypass and server-side versus client-side HPP

How to install the skill

Download the ZIP for the skill from the page you are reading. The skill folder is named offensive-parameter-pollution and its listed file is SKILL.md. Unzip it so the folder sits in one of the locations below.

You can install it for yourself across projects by placing the folder in ~/.claude/skills/, or for a single project by placing it in that project's .claude/skills/ folder. Alternatively, if you use the Claude apps, upload the skill under Settings → Capabilities → Skills.

• Personal: unzip into ~/.claude/skills/
• Project only: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload the skill

How to trigger the skill with natural requests

You do not need a special command. The skill activates when your conversation involves its trigger phrases, which include HTTP parameter pollution, HPP, duplicate parameter, WAF bypass, parsing differences, server-side HPP, client-side HPP and parameter injection. Name the target and the goal in plain language and mention the framework if you know it, because the agent's advice depends on how each technology resolves duplicates.

• Explain how an Express app handles a parameter sent twice, and suggest test requests for the search form
• Our PHP backend and an nginx gateway sit in front of the checkout API. Check whether they agree on duplicate parameters
• Suggest HPP test cases for the OAuth callback on my authorised test application
• Which parameter-pollution checks should I run first against this JSON API?

Examples of what you will get back

For a URL-based test, the source's basic pattern is to take a request such as a search with one parameter value, then repeat that parameter with a different value and observe which value the application uses: first, last or concatenated. The skill also covers the same idea for form bodies, JSON objects with duplicate keys, and repeated cookie or header names such as role=user; role=admin.

Expect the agent to ask what you have observed and to suggest next steps from those results, following the checklist order. The skill's notes also flag that many middlewares assume bracket notation for arrays, and that API gateways may normalise duplicates differently from backends.

What it needs and how it works

The source lists no requirements. It does not run scripts and does not use the network, so the skill itself only supplies methodology text that the agent applies in the conversation. Any actual testing against a system is something you would do with your own tools and permission.

• Requires: nothing listed
• Runs scripts: no
• Uses network: no

Safety notes before you test

The skill is framed around exploitation. Only use it on systems you own or have written permission to test. The source warns that testing production sites without coordination is risky, because suggested requests could trigger errors or unintended actions, such as the source's example of redeeming a coupon through a GraphQL batch mutation.

Treat the GraphQL alias and batch examples with care. Alias-based requests can repeat actions many times, so confirm with the system owner before running them against anything live.

• Test only authorised systems, ideally staging environments
• Coordinate with the owner before testing production
• Be cautious with mutations and batch requests that change data