Search
Security · PHP
Skills
Sort:BestMost starsTrending todayTrending this weekTrending this monthNewestRecently updatedName
| # | Skill | Repository | Stars | Used in | Tokens | Auto-check | Licence | Updated |
|---|---|---|---|---|---|---|---|---|
| 1 | Professional code security audit skill covering 55+ vulnerability types. | 3stoneBrother/ | 892 | 1 repo | ~2.7k | Automated safety check: Pass | No licence | 7 mo ago |
| 2 | 当用户要求审计 Java、.NET 或 PHP 源码/部署产物/反编译产物/安全发现，并需要默认脚本输出目录、报告输出目录、Java/.NET 反编译与反混淆参考、Java 组件 YAML 正则匹配扫描、确认漏洞判定标准、安全 Payload 和 BurpSuite 原始 HTTP 请求包证据时使用。仅用于授权代码审计和防御性安全验证。 | RuoJi6/ | 1k | — | ~447 | Automated safety check: Pass | No licence | 3 mo ago |
| 3 | Triage a reported security finding into a disposition: a private CVE (coordinated disclosure + advisory), a public hardening PR (fix in the open, no CVE), or not-a-security-issue (reply to reporter). | symfony/ | 31k | — | ~2.6k | Automated safety check: Pass | MIT | today |
| 4 | Review a change (a PR, the current branch diff, or a set of files) or audit a component or the whole tree for missing or incorrect security hardening. | symfony/ | 31k | — | ~2.9k | Automated safety check: Pass | MIT | today |
| 5 | 5.Skylos Run, interpret, or modify Skylos safely. An agent skill from duriantaco/skylos. | duriantaco/ | 844 | — | ~581 | Automated safety check: Pass | Apache-2.0 | today |
| 6 | Fingerprints which language or framework produced a serialized blob, then helps build a working gadget chain to test for insecure deserialization. | PentesterFlow/ | 1.4k | — | ~1.7k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 7 | Investigate and harden Skylos security behavior. An agent skill from duriantaco/skylos. | duriantaco/ | 844 | — | ~545 | Automated safety check: Pass | Apache-2.0 | today |
| 8 | PHP Web 归档解压（Zip Slip/路径穿越）审计工具。识别解压条目名如何与目标目录拼接、是否存在 base dir 约束缺失，输出可利用性分级、可观测 PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~883 | Automated safety check: Pass | No licence | 6 mo ago |
| 9 | Reviews WordPress plugin, theme and block code after an agent writes or edits it, catching missing escaping, nonces, capability checks and unprepared queries. | amElnagdy/ | 1.3k | — | ~2.4k | Automated safety check: Pass | MIT | 3 mo ago |
| 10 | PHP Web 全链路白盒代码安全审计流水线（多文件版编排）。作为总编排参考，按 Sink 类型调用各子审计 skill（php-route-mapper/php-auth-audit/php-route-tracer/php--audit），并复用统一输出与分级标准。 | 0xShe/ | 402 | 1 repo | ~4.9k | Automated safety check: Pass | No licence | 6 mo ago |
| 11 | PHP Web 源码鉴权机制审计工具。从源码中识别所有认证/鉴权实现并分析风险，输出路由-鉴权映射与漏洞分析（含 PoC 与修复建议）。 | 0xShe/ | 402 | 1 repo | ~951 | Automated safety check: Pass | No licence | 6 mo ago |
| 12 | Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis. | trilwu/ | 157 | — | ~3.2k | Automated safety check: Pass | MIT | 1 mo ago |
| 13 | PHP Web 源码命令注入审计工具。识别命令执行 Sink（exec/system/shellexec 等），追踪用户输入进入命令拼接，输出可利用性分级、PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~465 | Automated safety check: Pass | No licence | 6 mo ago |
| 14 | Web shell samples for detection and analysis: PHP, ASP, ASPX, JSP, Python, Perl shells. | Eyadkelleh/ | 388 | — | ~636 | Automated safety check: Pass | No licence | 4 mo ago |
| 15 | CodeIgniter 框架特效安全审计工具。针对 CodeIgniter 的 CSRF、XSS 输出过滤、数据库查询构造、路由与验证器配置、会话 Cookie 安全等机制进行白盒静态审计，并映射到通用漏洞类型体系（CSRF/AUTH/XSS/SQL/CFG/SESS 等）。 | 0xShe/ | 402 | 1 repo | ~477 | Automated safety check: Pass | No licence | 6 mo ago |
| 16 | 16.Ssti Server-Side Template Injection — fingerprint the engine first (Jinja2 / Twig / Velocity / Freemarker / ERB / Smarty / Mako / Handlebars / Pug), then escalate the engine-specific primitive to RCE or… | PentesterFlow/ | 1.4k | — | ~1.2k | Automated safety check: Pass | Apache-2.0 | 1 mo ago |
| 17 | PHP Web 配置安全审计工具。识别 CORS/错误暴露/调试开关/安全头/危险运行时开关等，输出分级、可利用性分析、PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~417 | Automated safety check: Notes | No licence | 6 mo ago |
| 18 | PHP Web 源码表达式注入（非模板）审计工具。识别用户可控表达式字符串进入表达式引擎求值/编译并最终导致敏感语义执行，输出可利用性分级、PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~720 | Automated safety check: Pass | No licence | 6 mo ago |
| 19 | Path traversal / Local File Inclusion detection→file-read→RCE for web apps. | s0ld13rr/ | 828 | — | ~602 | Automated safety check: Notes | MIT | 6 days ago |
| 20 | 20.Web Web 安全攻防技术，包括 SQL 注入、XSS、文件上传、命令注入、SSRF、反序列化等常见漏洞的识别与利用. An agent skill from MuWinds/BUUCTF_Agent. | MuWinds/ | 267 | — | ~463 | Automated safety check: Pass | Apache-2.0 | today |
| 21 | PHP Web 源码任意文件读取/路径穿越审计工具。识别文件读取 Sink，追踪路径来源与校验逻辑，输出可利用性分级、PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~558 | Automated safety check: Pass | No licence | 6 mo ago |
| 22 | Insecure deserialization detection and gadget chain exploitation | NeoTheCapt/ | 142 | — | ~836 | Automated safety check: Pass | No licence | 2 mo ago |
| 23 | Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel… | utkusen/ | 1.3k | — | ~7.3k | Automated safety check: Pass | MIT | 6 mo ago |
| 24 | PHP Web 源码任意文件写入审计工具。识别用户可控数据进入写入 Sink 的链路，追踪任意落点写入/路径穿越到 write，并评估写入后的可执行性（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~1.2k | Automated safety check: Pass | No licence | 6 mo ago |
| 25 | Analyze cryptographic code to detect operations that leak secret data through execution timing variations. | sickn33/ | 47k | 2 repos | ~2.4k | Automated safety check: Pass | MIT | today |
| 26 | AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching… | github/ | 40k | 1 repo | ~2.3k | Automated safety check: Notes | MIT | today |
| 27 | HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. | langbyyi/ | 135 | 1 repo | ~2.2k | Automated safety check: Pass | Apache-2.0 | yesterday |
| 28 | 28.Wordpress Complete WordPress development workflow covering theme development, plugin creation, WooCommerce integration, performance optimization, and security hardening. | sickn33/ | 47k | 2 repos | ~348 | Automated safety check: Pass | MIT | today |
| 29 | Laravel 框架特效安全审计工具。针对 Laravel 常见鉴权/CSRF/Session/模型填充/Blade 渲染等框架特性进行白盒静态审计，并将风险映射到你现有通用漏洞类型体系（AUTH/CSRF/LOGIC/XSS/CFG 等）。 | 0xShe/ | 402 | 1 repo | ~821 | Automated safety check: Pass | No licence | 6 mo ago |
| 30 | PHP Web 源码 LDAP 注入审计工具。识别用户可控数据进入 LDAP filter/DN 构造并被 ldapsearch/ldapread 执行，输出可利用性分级、PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~694 | Automated safety check: Pass | No licence | 6 mo ago |
| 31 | PHP Web 安全日志与监控审计工具。识别安全事件缺失、敏感信息写入日志、日志注入/伪造风险，以及日志与告警链路缺陷，并输出可利用性分级、可观测 PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~941 | Automated safety check: Pass | No licence | 6 mo ago |
| 32 | PHP Web 业务逻辑漏洞审计工具。识别认证/授权以外的逻辑缺陷：Mass Assignment、流程绕过、竞态条件、状态机缺陷、支付/权限时序漏洞等，输出证据链、分级、PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~533 | Automated safety check: Pass | No licence | 6 mo ago |
| 33 | PHP Web 源码路由与参数映射分析工具。从源码中提取所有入口路由与参数结构，输出完整请求模板与参数清单（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~847 | Automated safety check: Pass | No licence | 6 mo ago |
| 34 | PHP Web 路由到 Sink 的多层数据流追踪工具。根据用户指定路由，追踪从 handler 到最终敏感操作点，输出层级证据、参数变量追踪、可控性分析（不做漏洞结论）。 | 0xShe/ | 402 | 1 repo | ~2.3k | Automated safety check: Pass | No licence | 6 mo ago |
| 35 | PHP Web 源码 SSRF 审计工具。识别用户可控 URL/地址进入网络请求 Sink，追踪内网/协议/端口限制与回显，输出可利用性分级、PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~481 | Automated safety check: Pass | No licence | 6 mo ago |
| 36 | Symfony 框架特效安全审计工具。针对 Symfony 常见 security.yaml、CSRF、Twig/Twig raw、表达式与访问控制等框架机制做白盒静态审计，并将风险映射到通用漏洞类型体系（AUTH/CSRF/CFG/XSS/TPL/LOGIC 等）。 | 0xShe/ | 402 | 1 repo | ~599 | Automated safety check: Pass | No licence | 6 mo ago |
| 37 | ThinkPHP 框架特效安全审计工具。针对 ThinkPHP 常见的鉴权/CSRF/模板转义/ORM 写入（Mass Assignment）/调试与配置暴露等机制进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/TPL/XSS/LOGIC/CFG/SESS/SQL 等）。 | 0xShe/ | 402 | 1 repo | ~779 | Automated safety check: Pass | No licence | 6 mo ago |
| 38 | PHP Web 源码模板注入/SSTI 审计工具。识别模板引擎渲染点与模板名/表达式可控性，追踪到 eval/执行链，输出可利用性分级、PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~413 | Automated safety check: Pass | No licence | 6 mo ago |
| 39 | PHP 组件版本漏洞检测工具。扫描 composer.json / composer.lock 或 jar/包元信息，匹配已知漏洞规则并输出报告（包含可能的触发点分析框架）。 | 0xShe/ | 402 | 1 repo | ~504 | Automated safety check: Pass | No licence | 6 mo ago |
| 40 | WordPress 框架特效安全审计工具。针对 WordPress 常见 nonce/capability/checkadminreferer、AJAX action、escape/sanitize、重定向、安全上传与远程请求等机制进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/XSS/SQL/CFG/SSRF 等）。 | 0xShe/ | 402 | 1 repo | ~666 | Automated safety check: Pass | No licence | 6 mo ago |
| 41 | Yii 框架特效安全审计工具。针对 Yii（通常指 Yii2）访问控制（AccessControl/RBAC）、CSRF、输入过滤规则、输出编码策略、URL/重定向安全等进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/XSS/CFG/LOGIC 等）。 | 0xShe/ | 402 | 1 repo | ~528 | Automated safety check: Pass | No licence | 6 mo ago |
| 42 | Mine errorlog for creds, paths, SQL when leak hunt finds. An agent skill from uphiago/recon-skills. | uphiago/ | 1.3k | — | ~3.3k | Automated safety check: Pass | MIT | 1 mo ago |
| 43 | PHP Web 源码 CRLF/响应分割审计工具。识别用户输入进入 HTTP 响应头，分析换行/控制字符过滤与编码，输出分级、PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~323 | Automated safety check: Pass | No licence | 6 mo ago |
| 44 | PHP Web 源码加密与密钥安全审计工具。识别弱哈希/弱加密/硬编码密钥/签名校验缺陷，输出分级、PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~224 | Automated safety check: Pass | No licence | 6 mo ago |
| 45 | PHP Web 源码 CSRF 审计工具。识别状态变更接口是否受 CSRF 保护，追踪 token 生成、校验与绕过条件，输出可利用性分级、PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~398 | Automated safety check: Pass | No licence | 6 mo ago |
| 46 | PHP Web 源码 XSS 审计工具。识别用户输入进入输出上下文（HTML/属性/JS/URL/模板），分析转义与防护策略，输出可利用性分级、PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~370 | Automated safety check: Pass | No licence | 6 mo ago |
| 47 | PHP Web 源码 XXE 审计工具。识别 XML 解析点与实体处理配置，追踪 XML 输入来源与回显，输出可利用性分级、PoC 与修复建议（禁止省略）。 | 0xShe/ | 402 | 1 repo | ~368 | Automated safety check: Pass | No licence | 6 mo ago |
| 48 | PHP type juggling and weak comparison (==) bypass. An agent skill from langbyyi/CyberStrikeAI-SRC. | langbyyi/ | 135 | 1 repo | ~2.9k | Automated safety check: Pass | Apache-2.0 | yesterday |
