Php Archive Extract Audit
0xShe/PHP-Code-Audit-Skill
PHP Web 归档解压（Zip Slip/路径穿越）审计工具。识别解压条目名如何与目标目录拼接、是否存在 base dir 约束缺失，输出可利用性分级、可观测 PoC 与修复建议（禁止省略）。
Security pattern matching for code audit and content inspection: grep strings for source auditing, malicious-string signatures, PHP magic hashes, error-message patterns.
Install Security Patterns
$ npx skills add Ch1nfo/RiftX --skill security-patterns -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install Ch1nfo/RiftX security-patterns --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/Ch1nfo/RiftX.git skills-src && mkdir -p .claude/skills && cp -r skills-src/recommended-skills/security-patterns .claude/skills/security-patterns && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-patterns" agent skill from https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/security-patterns into .claude/skills/security-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-patterns", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/security-patternsType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add Ch1nfo/RiftX --skill security-patterns -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install Ch1nfo/RiftX security-patterns --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Ch1nfo/RiftX.git skills-src && mkdir -p .agents/skills && cp -r skills-src/recommended-skills/security-patterns .agents/skills/security-patterns && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-patterns" agent skill from https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/security-patterns into .agents/skills/security-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-patterns", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Ch1nfo/RiftX --skill security-patterns -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install Ch1nfo/RiftX security-patterns --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Ch1nfo/RiftX.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/recommended-skills/security-patterns .cursor/skills/security-patterns && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-patterns" agent skill from https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/security-patterns into .cursor/skills/security-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-patterns", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/Ch1nfo/RiftX.git --path recommended-skills/security-patterns--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add Ch1nfo/RiftX --skill security-patterns -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install Ch1nfo/RiftX security-patterns --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Ch1nfo/RiftX.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/recommended-skills/security-patterns .gemini/skills/security-patterns && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-patterns" agent skill from https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/security-patterns into .gemini/skills/security-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-patterns", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install Ch1nfo/RiftX security-patternsInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add Ch1nfo/RiftX --skill security-patterns -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/Ch1nfo/RiftX.git skills-src && mkdir -p .github/skills && cp -r skills-src/recommended-skills/security-patterns .github/skills/security-patterns && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-patterns" agent skill from https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/security-patterns into .github/skills/security-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-patterns", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Ch1nfo/RiftX --skill security-patterns -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install Ch1nfo/RiftX security-patterns --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Ch1nfo/RiftX.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/recommended-skills/security-patterns .opencode/skills/security-patterns && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-patterns" agent skill from https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/security-patterns into .opencode/skills/security-patterns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-patterns", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-patterns- GitHub stars
- 113
- Token cost
- ~425 tokens
- SKILL.md length
- 107 words
- Files
- 12 (incl. references)
- Skills in repo
- 6
- Repo updated
- First seen
- Licence
- MIT
At a glance
Security pattern matching for code audit and content inspection: grep strings for source auditing, malicious-string signatures, PHP magic hashes, error-message patterns.
- Repository scanning
- SKILL.md covers Description, When to Use This Skill and Key Files in This Skill
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
- Source-code auditing
What it does
Security Patterns is an agent skill from Ch1nfo/RiftX. Security pattern matching for code audit and content inspection: grep strings for source auditing, malicious-string signatures, PHP magic hashes, error-message patterns. Use for repository scanning, source-code auditing, and detecting dangerous functions or malicious content in files.
Its SKILL.md is about 430 tokens, which your agent loads only when the skill is triggered. The skill folder holds 14 other files, including reference files (for example `references/Pattern-Matching/README.md` and `references/Pattern-Matching/grepstrings-auditing-php.md`).
It sits in Security. It works with PHP. The repository describes itself as: Pentest anything you want. The licence is MIT.
When your agent uses it
- Repository scanning
- Source-code auditing
- Detecting dangerous functions
- Malicious content in files
Example prompts
- “/security-patterns”
What it can do on your machine
Read from SKILL.md and the folder at commit 1e3369f. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
github.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Patterns loads about 425 tokens when it runs, and up to ~14k if it reads all its reference files. Until then it costs about 76 tokens; SKILL.md has 107 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from Ch1nfo/RiftX at commit 1e3369f, republished under its MIT licence (© Ch1nfo). 107 words, ~425 tokens.
Download SKILL.mdSave it as
.claude/skills/security-patterns/SKILL.md (or your agent's skills folder). This skill also uses 11 other files; get the full folder from GitHub.- name
- security-patterns
- description
- Security pattern matching for code audit and content inspection: grep strings for source auditing, malicious-string signatures, PHP magic hashes, error-message patterns. Use for repository scanning, source-code auditing, and detecting dangerous functions or malicious content in files.
SecLists Pattern-Matching
Description
Security pattern matching for code audit and content inspection: grep strings for source auditing, malicious-string signatures, PHP magic hashes, and error-message patterns.
Source: SecLists/Pattern-Matching Repository: https://github.com/danielmiessler/SecLists License: MIT
When to Use This Skill
Use this skill when you need:
- Repository / source-code security auditing
- Detecting dangerous functions in code
- Scanning files for malicious strings or signatures
- PHP magic hash checks
- Error-message and known-vulnerable pattern matching
Key Files in This Skill
references/Pattern-Matching/grepstrings-basic.txt- Grep patterns for security auditingreferences/Pattern-Matching/repo-scan.txt- Repository scanning patternsreferences/Pattern-Matching/malicious.txt- Malicious string signaturesreferences/Pattern-Matching/errors.txt- Error message patternsreferences/Pattern-Matching/php-magic-hashes.txt- PHP magic hashesreferences/Pattern-Matching/dangerous-functions-angular.txt- Dangerous Angular functionsreferences/Pattern-Matching/pcap-strings.txt- PCAP string patternsreferences/Pattern-Matching/Source-Code-(PHP)/php-auditing.txt- PHP source auditing patterns
© Ch1nfo, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 11 other files (references) in recommended-skills/security-patterns of Ch1nfo/RiftX.
- SKILL.md
- references/Pattern-Matching/README.md
- references/Pattern-Matching/Source-Code-(PHP)/php-auditing.txt
- references/Pattern-Matching/dangerous-functions-angular.txt
- references/Pattern-Matching/errors.txt
- references/Pattern-Matching/grepstrings-auditing-php.md
- references/Pattern-Matching/grepstrings-basic.txt
- references/Pattern-Matching/malicious.txt
- references/Pattern-Matching/pcap-strings.txt
- references/Pattern-Matching/php-magic-hashes.txt
- references/Pattern-Matching/repo-scan.txt
- references/Pattern-Matching/thickclient-basic.txt
Open the folder on GitHubat commit 1e3369f
Compare with similar skills
Security Patterns next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Patterns this skillCh1nfo/RiftX | 113 | — | ~425 | Automated safety check: Pass | MIT | |
| Php Archive Extract Audit0xShe/PHP-Code-Audit-Skill | 402 | 1 repos | ~883 | Automated safety check: Pass | None | |
| Php Auth Audit0xShe/PHP-Code-Audit-Skill | 402 | 1 repos | ~951 | Automated safety check: Pass | None | |
| Auditing Code For Vulnerabilitiestrilwu/secskills | 156 | — | ~3.2k | Automated safety check: Pass | MIT | |
| Php Cmd Audit0xShe/PHP-Code-Audit-Skill | 402 | 1 repos | ~465 | Automated safety check: Pass | None | |
| Php Config Audit0xShe/PHP-Code-Audit-Skill | 402 | 1 repos | ~417 | Automated safety check: Notes | None |
Similar skills
Php Auth Audit
0xShe/PHP-Code-Audit-Skill
PHP Web 源码鉴权机制审计工具。从源码中识别所有认证/鉴权实现并分析风险，输出路由-鉴权映射与漏洞分析（含 PoC 与修复建议）。
Auditing Code For Vulnerabilities
trilwu/secskills
Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis.
Php Cmd Audit
0xShe/PHP-Code-Audit-Skill
PHP Web 源码命令注入审计工具。识别命令执行 Sink（exec/system/shellexec 等），追踪用户输入进入命令拼接，输出可利用性分级、PoC 与修复建议（禁止省略）。
Php Config Audit
0xShe/PHP-Code-Audit-Skill
PHP Web 配置安全审计工具。识别 CORS/错误暴露/调试开关/安全头/危险运行时开关等，输出分级、可利用性分析、PoC 与修复建议（禁止省略）。
Php Expr Audit
0xShe/PHP-Code-Audit-Skill
PHP Web 源码表达式注入（非模板）审计工具。识别用户可控表达式字符串进入表达式引擎求值/编译并最终导致敏感语义执行，输出可利用性分级、PoC 与修复建议（禁止省略）。
More from Ch1nfo/RiftX
Recon Crawl
Ch1nfo/RiftX
Attack-surface crawling with the crawl tool — BFS link/form/hidden-field collection, JS-bundle API route extraction, and auth boundary mapping through the scoped browser.
LLM Testing
Ch1nfo/RiftX
Comprehensive LLM security testing prompts for bias detection, data leakage, alignment testing, and adversarial prompt resistance.
Security Fuzzing
Ch1nfo/RiftX
Essential fuzzing payloads: SQL injection, command injection, special characters.
Security Webshells
Ch1nfo/RiftX
Webshell samples for detection and analysis webshell 样本: PHP, ASP, ASPX, JSP, Python, Perl shells.
Security Usernames
Ch1nfo/RiftX
Top username lists for enumeration: common usernames, default credentials, names.
Related
Works with
Categories
Questions about Security Patterns
What does Security Patterns do?
Security pattern matching for code audit and content inspection: grep strings for source auditing, malicious-string signatures, PHP magic hashes, error-message patterns. Security Patterns is an agent skill from Ch1nfo/RiftX. Security pattern matching for code audit and content inspection: grep strings for source auditing, malicious-string signatures, PHP magic hashes, error-message patterns.
When should I use Security Patterns?
Security Patterns fits situations like: repository scanning; source-code auditing; detecting dangerous functions; malicious content in files.
How do I install Security Patterns in Claude Code?
Run `npx skills add Ch1nfo/RiftX --skill security-patterns -a claude-code`. Or copy the skill folder (recommended-skills/security-patterns in Ch1nfo/RiftX) into .claude/skills/security-patterns in your project. Claude Code loads it when a task matches its description.
How do I install Security Patterns in Codex?
Run `npx skills add Ch1nfo/RiftX --skill security-patterns -a codex`. Or copy the skill folder (recommended-skills/security-patterns in Ch1nfo/RiftX) into .agents/skills/security-patterns in your project. Codex loads it when a task matches its description.
Can I use Security Patterns in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Ch1nfo/RiftX --skill security-patterns -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-patterns, .gemini/skills/security-patterns, .github/skills/security-patterns and .opencode/skills/security-patterns in your project.
What does Security Patterns need to run?
SKILL.md names no scripts, command-line tools or credentials: Security Patterns is instructions for the agent only.
Does Security Patterns access the network?
SKILL.md names 1 domain. As links in the text: github.com. This is read from the text; nothing was executed.
Is Security Patterns safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Security Patterns use?
Security Patterns is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Security Patterns use?
About 425 tokens (SKILL.md is roughly 1.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 14k tokens, read only when the agent opens those files.
What are the alternatives to Security Patterns?
Skills that share tags, products or a category with Security Patterns: Php Archive Extract Audit (0xShe/PHP-Code-Audit-Skill, 402 stars), Php Auth Audit (0xShe/PHP-Code-Audit-Skill, 402 stars), Auditing Code For Vulnerabilities (trilwu/secskills, 156 stars) and Php Cmd Audit (0xShe/PHP-Code-Audit-Skill, 402 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Patterns?
Ch1nfo (a GitHub user) maintains it in Ch1nfo/RiftX, which has 113 GitHub stars. The repository holds 6 skills in this directory. The repository was last updated on September 21, 2026.
Source: Ch1nfo/RiftX on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.