Agent skill

ffuf Web Fuzzer

by AgentSecOps in AgentSecOps/SecOpsAgentKit

Runs ffuf for DAST work: directory and file discovery, GET and POST parameter fuzzing, virtual host enumeration and filtered, recursive scans.

Custom licenceAuto-check passedSecurity

Install ffuf Web Fuzzer

skills CLI

$ npx skills add AgentSecOps/SecOpsAgentKit --skill dast-ffuf -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install AgentSecOps/SecOpsAgentKit dast-ffuf --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/appsec/dast-ffuf .claude/skills/dast-ffuf && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "dast-ffuf" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/appsec/dast-ffuf into .claude/skills/dast-ffuf/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dast-ffuf", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/appsec/dast-ffuf

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add AgentSecOps/SecOpsAgentKit --skill dast-ffuf -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install AgentSecOps/SecOpsAgentKit dast-ffuf --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/appsec/dast-ffuf .agents/skills/dast-ffuf && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "dast-ffuf" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/appsec/dast-ffuf into .agents/skills/dast-ffuf/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dast-ffuf", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add AgentSecOps/SecOpsAgentKit --skill dast-ffuf -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install AgentSecOps/SecOpsAgentKit dast-ffuf --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/appsec/dast-ffuf .cursor/skills/dast-ffuf && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "dast-ffuf" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/appsec/dast-ffuf into .cursor/skills/dast-ffuf/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dast-ffuf", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/AgentSecOps/SecOpsAgentKit.git --path skills/appsec/dast-ffuf

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add AgentSecOps/SecOpsAgentKit --skill dast-ffuf -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install AgentSecOps/SecOpsAgentKit dast-ffuf --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/appsec/dast-ffuf .gemini/skills/dast-ffuf && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "dast-ffuf" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/appsec/dast-ffuf into .gemini/skills/dast-ffuf/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dast-ffuf", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install AgentSecOps/SecOpsAgentKit dast-ffuf

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add AgentSecOps/SecOpsAgentKit --skill dast-ffuf -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/appsec/dast-ffuf .github/skills/dast-ffuf && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "dast-ffuf" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/appsec/dast-ffuf into .github/skills/dast-ffuf/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dast-ffuf", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add AgentSecOps/SecOpsAgentKit --skill dast-ffuf -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install AgentSecOps/SecOpsAgentKit dast-ffuf --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/AgentSecOps/SecOpsAgentKit.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/appsec/dast-ffuf .opencode/skills/dast-ffuf && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "dast-ffuf" agent skill from https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/appsec/dast-ffuf into .opencode/skills/dast-ffuf/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dast-ffuf", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: dast-ffuf
GitHub stars: 219
Used in: 1 other repo
Token cost: ~3.3k tokens
SKILL.md length: 762 words
Files: 6 (incl. references, assets)
Skills in repo: 24
Repo updated: Apr 15, 2026
First seen: Oct 7, 2026
Licence: Custom licence

At a glance

Runs ffuf for DAST work: directory and file discovery, GET and POST parameter fuzzing, virtual host enumeration and filtered, recursive scans.

Works in 5 steps: Start with common directory wordlist → Review discovered directories (focus on… → Enumerate files in discovered directories → …
Discovering hidden directories and files on a web application under test
SKILL.md covers Overview, Installation, Quick Start and Core Workflows, plus 8 more sections
Calls go, apt and brew

What it does

ffuf is a Go web fuzzer that replaces a FUZZ keyword in a request with entries from a wordlist. The skill covers installing it with go install and quick directory discovery, then walks through workflows: directory and file enumeration with SecLists lists, status-code matching and extensions such as .php and .bak, and parameter fuzzing of GET names and values and of POST form or JSON data, tracked with a progress checklist.

It supports the clusterbomb, pitchfork and sniper modes, recursive scanning with a depth limit and filtering by size or status to cut false positives. The listed uses also include enumerating virtual hosts and subdomains, checking authentication endpoints, finding backup files and sensitive data exposures and general reconnaissance. Findings should be validated manually and documented. The bundle adds a CI config template, a rule template, an example and a workflow checklist.

When your agent uses it

Discovering hidden directories and files on a web application under test
Finding hidden GET or POST parameters on an endpoint
Enumerating virtual hosts or subdomains of a target

Example prompts

“Run directory discovery against the staging site with the common SecLists wordlist.”
“Fuzz the parameter names on the search endpoint and filter out empty responses.”
“Enumerate virtual hosts for the test domain and list the ones that respond differently.”

Requirements

ffuf installed, for example with go install
Wordlists such as SecLists

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

Start with common directory wordlist
Review discovered directories (focus on 200, 403 status codes)
Enumerate files in discovered directories
Use recursive mode for deep enumeration
Document findings and test discovered endpoints

What it can do on your machine

Read from SKILL.md and the folder at commit 6e25a4b. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- go
- apt
- brew
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
- github.com
- owasp.org
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

ffuf Web Fuzzer loads about 3.3k tokens when it runs, and up to ~9.4k if it reads all its reference files. Until then it costs about 170 tokens; SKILL.md has 762 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~170
When it runs · the whole SKILL.md, loaded when a task matches: ~3.3k
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~9.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 762 words (~3,339 tokens).

“ffuf is a fast web fuzzer written in Go designed for discovering hidden resources, testing parameters, and performing comprehensive web application reconnaissance. It uses the FUZZ keyword as a placeholder for wordlist entries and supports advanced filtering, multiple fuzzing modes…”

— opening of SKILL.md by AgentSecOps, Custom licence

name: dast-ffuf
version: 0.1.0
maintainer: SirAppSec
category: appsec
tags: dast, fuzzing, web-fuzzer, directory-enumeration, parameter-fuzzing, vhost-discovery, ffuf, reconnaissance
frameworks: OWASP
dependencies.tools: ffuf
references: https://github.com/ffuf/ffuf

Outline of SKILL.md

ffuf - Fast Web Fuzzer
Overview
Installation
Quick Start
Core Workflows
Workflow 1: Directory and File Enumeration
Workflow 2: Parameter Fuzzing (GET/POST)
Workflow 3: Virtual Host and Subdomain Discovery
Workflow 4: Authentication Endpoint Fuzzing
Workflow 5: Backup and Sensitive File Discovery
Fuzzing Modes
Filtering and Matching
Common Patterns
Pattern 1: API Endpoint Discovery
Pattern 2: Extension Fuzzing
Pattern 3: Rate-Limited Fuzzing
Pattern 4: Custom Header Fuzzing
Pattern 5: Cookie Fuzzing
Output Formats
Security Considerations
Integration Points
Reconnaissance Workflow
CI/CD Security Testing
Integration with Burp Suite
Troubleshooting
Issue: Too Many False Positives
Issue: Rate Limiting or Blocking
Issue: Large Wordlist Takes Too Long
Issue: Missing Discovered Content
OWASP Testing Integration

Read the full SKILL.md on GitHub

Files

SKILL.md and 5 other files (references, assets) in skills/appsec/dast-ffuf of AgentSecOps/SecOpsAgentKit.

SKILL.md
assets/.gitkeep
assets/ci-config-template.yml
assets/rule-template.yaml
references/EXAMPLE.md
references/WORKFLOW_CHECKLIST.md

Open the folder on GitHubat commit 6e25a4b

Used in 1 other repository

We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in AgentSecOps/SecOpsAgentKit, which our catalogue first saw on October 7, 2026.

aiskillstore/marketplaceskills/agentsecops/dast-ffuf

Compare with similar skills

ffuf Web Fuzzer next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

ffuf Web Fuzzer compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
ffuf Web Fuzzer this skillAgentSecOps/SecOpsAgentKit	219	1 repos	~3.3k	Automated safety check: Pass	Custom licence	5 mo ago
Security Auditoreigent-ai/eigent	15k	—	~1.8k	Automated safety check: Notes	Apache-2.0	today
Code Audit3stoneBrother/code-audit	893	1 repos	~2.7k	Automated safety check: Pass	None	7 mo ago
Security Audit Scannerruvnet/ruflo	74k	2 repos	~823	Automated safety check: Pass	MIT	today
Octopus Security Auditnyldn/claude-octopus	4.2k	1 repos	~2.3k	Automated safety check: Pass	MIT	today
Security Verification Gatefengshao1227/ccg-workflow	5.9k	—	~621	Automated safety check: Notes	MIT	22 days ago

Similar skills

Security Auditor
eigent-ai/eigent
Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.
15k GitHub stars~1.8k tokensUpdated today
SecurityAuto-check: notes
Code Audit
3stoneBrother/code-audit
Professional code security audit skill covering 55+ vulnerability types.
893 GitHub starsUsed in 1 repo~2.7k tokens
SecurityAuto-check passed
Security Audit Scanner
ruvnet/ruflo
Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.
74k GitHub starsUsed in 2 repos~823 tokens
SecurityAuto-check passed
Octopus Security Audit
nyldn/claude-octopus
OWASP compliance, vulnerability scanning, and adversarial red team testing — use for security reviews
4.2k GitHub starsUsed in 1 repo~2.3k tokens
SecurityAuto-check passed
Security Verification Gate
fengshao1227/ccg-workflow
Scans code with a bundled Node script for injection, secrets, XSS and other risky patterns, ranks findings by severity and checks that security decisions are documented.
5.9k GitHub stars~621 tokensUpdated 22 days ago
SecurityAuto-check: notes
Secknowledge Skill
Pa55w0rd/secknowledge-skill
Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 173 风险 + OWASP Top 10 (LLM/ASI/WSTG)。
423 GitHub stars~2.7k tokensUpdated 3 mo ago
SecurityAuto-check passed

Questions about ffuf Web Fuzzer

What does ffuf Web Fuzzer do?

Runs ffuf for DAST work: directory and file discovery, GET and POST parameter fuzzing, virtual host enumeration and filtered, recursive scans. ffuf is a Go web fuzzer that replaces a FUZZ keyword in a request with entries from a wordlist.bak, and parameter fuzzing of GET names and values and of POST form or JSON data, tracked with a progress checklist.

When should I use ffuf Web Fuzzer?

ffuf Web Fuzzer fits situations like: discovering hidden directories and files on a web application under test; finding hidden GET or POST parameters on an endpoint; enumerating virtual hosts or subdomains of a target.

How do I install ffuf Web Fuzzer in Claude Code?

Run `npx skills add AgentSecOps/SecOpsAgentKit --skill dast-ffuf -a claude-code`. Or copy the skill folder (skills/appsec/dast-ffuf in AgentSecOps/SecOpsAgentKit) into .claude/skills/dast-ffuf in your project. Claude Code loads it when a task matches its description.

How do I install ffuf Web Fuzzer in Codex?

Run `npx skills add AgentSecOps/SecOpsAgentKit --skill dast-ffuf -a codex`. Or copy the skill folder (skills/appsec/dast-ffuf in AgentSecOps/SecOpsAgentKit) into .agents/skills/dast-ffuf in your project. Codex loads it when a task matches its description.

Can I use ffuf Web Fuzzer in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add AgentSecOps/SecOpsAgentKit --skill dast-ffuf -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/dast-ffuf, .gemini/skills/dast-ffuf, .github/skills/dast-ffuf and .opencode/skills/dast-ffuf in your project.

What does ffuf Web Fuzzer need to run?

Going by SKILL.md and its folder, ffuf Web Fuzzer needs the command-line tools its instructions call (go, apt and brew). Our summary lists: ffuf installed, for example with go install; Wordlists such as SecLists.

Does ffuf Web Fuzzer access the network?

SKILL.md names 2 domains. As links in the text: github.com and owasp.org. This is read from the text; nothing was executed.

Is ffuf Web Fuzzer safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does ffuf Web Fuzzer use?

ffuf Web Fuzzer has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.

How many tokens does ffuf Web Fuzzer use?

About 3.3k tokens (SKILL.md is roughly 13k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 6k tokens, read only when the agent opens those files.

What are the alternatives to ffuf Web Fuzzer?

Skills that share tags, products or a category with ffuf Web Fuzzer: Security Auditor (eigent-ai/eigent, 15k stars), Code Audit (3stoneBrother/code-audit, 893 stars), Security Audit Scanner (ruvnet/ruflo, 74k stars) and Octopus Security Audit (nyldn/claude-octopus, 4.2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains ffuf Web Fuzzer?

AgentSecOps (a GitHub organization) maintains it in AgentSecOps/SecOpsAgentKit, which has 219 GitHub stars. The repository holds 24 skills in this directory. The repository was last updated on April 15, 2026.

Source: AgentSecOps/SecOpsAgentKit on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

ffuf Web Fuzzer

Install ffuf Web Fuzzer

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Files

Used in 1 other repository

Compare with similar skills

Similar skills

Security Auditor

Code Audit

Security Audit Scanner

Octopus Security Audit

Security Verification Gate

Secknowledge Skill

More from AgentSecOps/SecOpsAgentKit

Sast Semgrep

Secrets Gitleaks

DefectDojo Vulnerability Management

TShark Traffic Analysis

Container Scanning with Grype

Hadolint Dockerfile Security Linting

Questions about ffuf Web Fuzzer

Install ffuf Web Fuzzer

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Files

Used in 1 other repository

Compare with similar skills

Similar skills

More from AgentSecOps/SecOpsAgentKit

Related

Questions about ffuf Web Fuzzer