Security · PHP

XSLT injection testing: processor fingerprinting, XXE and document() SSRF, EXSLT write primitives, PHP/Java/.NET extension RCE surfaces.

langbyyi/CyberStrikeAI-SRC

Detect and exploit local and remote file inclusion vulnerabilities for sensitive data access and code execution

NeoTheCapt/RedteamAgent

Detect Remote Code Execution (RCE) vulnerabilities in a codebase using a three-phase approach: recon (find dangerous execution sinks), batched verify (trace user input to sinks in parallel…

utkusen/sast-skills

Mass scan for exposed env files, backups, and git configs. An agent skill from uphiago/recon-skills.

uphiago/recon-skills

WordPress plugin development with hooks, security, REST API, custom post types.

secondsky/claude-skills

Hunt Insecure Deserialization

sickn33/agentic-awesome-skills

Hunt file upload bugs

sickn33/agentic-awesome-skills

Insecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node.

Encod3d-Sec/TORCH

WordPress security code review and vulnerability detection. An agent skill from jorgerosal/wordpress-skills.

jorgerosal/wordpress-skills

Audit PHP web application source for critical vulnerabilities using PHP's specific sink and footgun catalog — object injection via unserialize and phar:// POP chains, type-juggling and magic-hash…

trilwu/secskills

CTF 挑战中的源码审计方法。当发现 .git 目录、.bak/.zip 备份、/proc/self/environ 泄露源码时使用。与真实代码审计不同——CTF 源码中的漏洞是故意设置的，通常只有 1-2 个关键点。先找危险函数（sink），再追溯输入（source）到该函数的路径。覆盖 PHP/Python/Node.js/Java 四种语言的危险函数和漏洞模式

wgpsec/AboutSecurity

PHP-only security standards for database access, password handling, and input validation.

HoangNguyen0403/agent-skills-standard

Security pattern matching for code audit and content inspection: grep strings for source auditing, malicious-string signatures, PHP magic hashes, error-message patterns.

Ch1nfo/RiftX

Webshell samples for detection and analysis webshell 样本: PHP, ASP, ASPX, JSP, Python, Perl shells.

Ch1nfo/RiftX

Static ReDoS (Regular Expression Denial of Service) vulnerability scanner and regex quality auditor for codebases.

LeoYeAI/openclaw-master-skills

CTF/靶场 Flag 强制验证流程。当通过任何方式发现疑似 flag 字符串（含 flag{、FLAG{、ctf{ 等格式）时必须立即使用此 skill 验证，不要直接提交。防止因字符截断、编码错误、HTML 实体、base64 不完整解码、hex 截断等原因导致提交错误 flag。即使 flag 看起来完整，也可能存在隐藏字符或编码问题。覆盖 SQL…

wgpsec/AboutSecurity

CTF Web 挑战专用侦察方法。当面对 CTF 靶场目标需要快速发现攻击入口时使用。与真实渗透的 recon 不同——CTF 是单个应用、有意留线索、侦察应在 2-3 轮内完成。覆盖源码泄露、备份文件、隐藏路径、页面线索提取

wgpsec/AboutSecurity

使用 dirsearch 进行 Web 目录和文件暴力枚举。当需要发现隐藏的目录、文件、后台路径、备份文件时使用。dirsearch 内置高质量字典，支持多扩展名、递归扫描、状态码过滤。任何涉及目录枚举、路径发现、后台查找、敏感文件发现的场景都应使用此技能

wgpsec/AboutSecurity

当拿到源码、代码片段、反编译产物，或用户要求代码审计时调用。负责输入点→传播链→危险函数Sink的静态审计，跨语言（PHP/Java/Python/Node/Go）危险函数速查，输出可疑调用链与缺陷触发条件。

zhaji2333/CkSKILLS

Configure PHP ecosystem tooling, dependency management, and static analysis.

HoangNguyen0403/agent-skills-standard

PHP 源码认证、配置与逻辑类漏洞审计。当在 PHP 白盒审计中需要检测认证绕过、 权限控制、安全配置、密码学误用或业务逻辑漏洞时触发。

wgpsec/AboutSecurity

PHP 框架特定安全审计。当在 PHP 白盒审计中已识别目标使用特定框架、 需要检查框架特有安全机制和常见配置缺陷时触发。

wgpsec/AboutSecurity

PHP 源码前端交互类漏洞审计。当在 PHP 白盒审计中需要检测前端安全相关漏洞时触发. An agent skill from wgpsec/AboutSecurity.

wgpsec/AboutSecurity

PHP 源码序列化与模板类漏洞审计。当在 PHP 白盒审计中需要检测反序列化、XML 解析或模板注入漏洞时触发. An agent skill from wgpsec/AboutSecurity.

wgpsec/AboutSecurity

Information disclosure detection — error messages, files, headers, debug endpoints

NeoTheCapt/RedteamAgent

Server-side template injection detection, engine identification, and RCE

NeoTheCapt/RedteamAgent