I shared a Dashboard with public access and add &refresh=xx param for auto-refresh, but it will refresh and read directly from database not cache. I have set some Refresh Schedule for needed queries.

A public user should only have read from cache permission, I think.

Or add a new param use for auto-refresh and read from cache?

Am I Missing Something?

read from cache permission would be helpful to avoid abusing the database from public visitors.

Right now, public dashboards without parameters can only read from the cache. They only re-execute against the database if a cached value is unavailable (maybe it was cleaned up by accident).

Dashboards with parameters can re-execute if the user changes a parameter value. But they will still load a cached value onLoad if one is available.