Agent skill

Adaptive Web Fuzzing

Adaptive web fuzzing for pentests, bug bounty and CTF work: picks the smallest suitable SecLists wordlist per target surface and calibrates filters against soft-404 responses.

MITAuto-check passedSecurity

Install Adaptive Web Fuzzing

skills CLI

$ npx skills add Encod3d-Sec/TORCH --skill fuzz -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install Encod3d-Sec/TORCH fuzz --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/workflow/fuzz .claude/skills/fuzz && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "fuzz" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/fuzz into .claude/skills/fuzz/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "fuzz", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/fuzz

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add Encod3d-Sec/TORCH --skill fuzz -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install Encod3d-Sec/TORCH fuzz --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/workflow/fuzz .agents/skills/fuzz && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "fuzz" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/fuzz into .agents/skills/fuzz/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "fuzz", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add Encod3d-Sec/TORCH --skill fuzz -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install Encod3d-Sec/TORCH fuzz --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/workflow/fuzz .cursor/skills/fuzz && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "fuzz" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/fuzz into .cursor/skills/fuzz/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "fuzz", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/Encod3d-Sec/TORCH.git --path skills/workflow/fuzz

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add Encod3d-Sec/TORCH --skill fuzz -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install Encod3d-Sec/TORCH fuzz --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/workflow/fuzz .gemini/skills/fuzz && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "fuzz" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/fuzz into .gemini/skills/fuzz/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "fuzz", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install Encod3d-Sec/TORCH fuzz

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add Encod3d-Sec/TORCH --skill fuzz -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/workflow/fuzz .github/skills/fuzz && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "fuzz" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/fuzz into .github/skills/fuzz/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "fuzz", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add Encod3d-Sec/TORCH --skill fuzz -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install Encod3d-Sec/TORCH fuzz --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/workflow/fuzz .opencode/skills/fuzz && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "fuzz" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/fuzz into .opencode/skills/fuzz/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "fuzz", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: fuzz
GitHub stars: 329
Used in: 1 other repo
Token cost: ~1.3k tokens
SKILL.md length: 531 words
Files: 1
Skills in repo: 35
Repo updated: Sep 1, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Adaptive web fuzzing for pentests, bug bounty and CTF work: picks the smallest suitable SecLists wordlist per target surface and calibrates filters against soft-404 responses.

Works in 8 steps: Profile (do this first) → Two axes → Select (deterministic) - always via… → …
Running content or vhost discovery against a web target in a security engagement
SKILL.md covers 0. Profile (do this first), 1. Two axes, 2. Select (deterministic) -… and 3. Calibrate (native first,…, plus 5 more sections
Calls bash and python3

What it does

The skill reads the engagement type from the active target's state.md and sets a profile. The ctf profile runs loud and fast, pt uses a calibrated rate and obeys rules-of-engagement flags such as no_bruteforce and no_dos by skipping the brute-force tiers, and bb runs at a low rate with jitter while watching for a ban. Work then proceeds on two axes: widening across content, files, vhosts, APIs and artifacts, and deepening into hidden parameters once an endpoint is observed to accept input.

Wordlists are chosen by a script, wl-pick.sh, which prints the SecLists base, the profile flags and ordered list paths from smallest to largest. The agent is told never to pick a list from memory or to start with the 220k directory-list-2.3-medium list. Filters are calibrated with ffuf -ac and feroxbuster auto-filtering, falling back to probing random bogus paths when a wildcard soft-404 fools them. The agent then climbs from the harness list to SecLists, then cewl-generated words, then product-specific lists as fingerprints appear, and backs off when it detects a WAF or throttling.

When your agent uses it

Running content or vhost discovery against a web target in a security engagement
Looking for hidden parameters on an endpoint that accepts input
Choosing which wordlist to run next for a given surface

Example prompts

“Run content discovery on the staging site, respecting the rules of engagement.”
“Pick a wordlist for vhost fuzzing on this target and explain the choice.”
“That endpoint takes a search input, so fuzz it for hidden parameters.”

Requirements

ffuf, gobuster, feroxbuster, cewl or arjun
SecLists wordlists
The wl-pick.sh script and a target state.md file

Workflow steps

8 steps, taken from the step headings in SKILL.md.

Profile (do this first)
Two axes
Select (deterministic) - always via wl-pick.sh
Calibrate (native first, backstop with judgment)
Climb tiers on SIGNAL (the adaptive core)
Pivot to the parameter axis
WAF / throttle / Cloudflare
403 is not a dead end

What it can do on your machine

Read from SKILL.md and the folder at commit d21b6c9. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- bash
- python3
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Adaptive Web Fuzzing loads about 1.3k tokens when it runs. Until then it costs about 165 tokens; SKILL.md has 531 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~165
When it runs · the whole SKILL.md, loaded when a task matches: ~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from Encod3d-Sec/TORCH at commit d21b6c9, republished under its MIT licence (© Encod3d-Sec). 531 words, ~1,264 tokens.

Download SKILL.mdSave it as .claude/skills/fuzz/SKILL.md (or your agent's skills folder).

name: fuzz
description: Adaptive, targeted web fuzzing - deterministic wordlist selection (wl-pick.sh) plus judgment. Picks the right SecLists list per surface (content/vhost/api/params/artifacts) smallest-first, calibrates filters against soft-404s, recurses, escalates T0 harness -> T1 seclists -> T2 cewl -> T3 app-specific on signal, pivots to hidden-param fuzzing, and detects/handles WAF/Cloudflare/throttle (backoff, origin-bypass, or hard STOP on the DoS tell). Engagement-type aware (ctf loud, pt calibrated, bb stealth). Use for "fuzz", "content discovery", "directory brute", "vhost fuzz", "find hidden params", "which wordlist", "gobuster/ffuf/feroxbuster/cewl/arjun".

fuzz - adaptive web fuzzing

0. Profile (do this first)

Read engagement_type from the active targets/<eng>/state.md frontmatter and set the profile:

ctf - loud/fast, ignore WAF, recurse deep, exhaust the big list.
pt - calibrated rate, obey RoE flags (no_bruteforce/no_dos -> SKIP the brute tiers entirely).
bb - stealth: low rate + jitter, watch for the ban BEFORE it lands, request-budget aware. wl-pick.sh emits the profile flags; you apply them.

1. Two axes

Surface (widen): content, files, vhost, api, artifacts. Recursive by default.
Parameter (deepen): once an endpoint takes input, fuzz hidden params. Triggered by OBSERVING a param-accepting endpoint, never blind.

2. Select (deterministic) - always via wl-pick.sh

bash

# what to run for a surface, given the engagement type and any fingerprint:
bash scripts/wl-pick.sh content "" ctf          # generic content discovery
bash scripts/wl-pick.sh content wordpress bb    # WordPress-aware, BB-stealth
bash scripts/wl-pick.sh vhost "" pt
bash scripts/wl-pick.sh params "" bb

It prints the seclists base, the profile flags line, and the ordered absolute paths (T0 harness -> T3 fingerprint list -> T1 surface lists, size-ordered). NEVER hand-pick a list from memory and NEVER start with directory-list-2.3-medium (220k). The size order is already correct in the output; run top-to-bottom, stop climbing when you have enough signal.

3. Calibrate (native first, backstop with judgment)

Default to ffuf -ac/-acc and feroxbuster auto-filtering.
If a wildcard/soft-404 fools -ac (everything returns 200 with varying size): fire 2-3 known-bogus random paths first, read status/size/words, then set explicit -fs/-fw on the catch-all baseline, or -mc 200,301,302,401,403 on a clean 404.
READ tool output END-TO-END, never a grep. A real hit hides in the noise.

4. Climb tiers on SIGNAL (the adaptive core)

Climb T0 -> T1 -> T2 -> T3 when the current tier is exhausted OR a fingerprint unlocks a better list:

T2 cewl when T0/T1 run dry: cewl -d 3 -m 5 --lowercase -w targets/<eng>/custom-words.txt https://TARGET then feed that list back through the same axis. See [[cewl]].
T3 app-specific the moment you fingerprint a known product: re-run wl-pick.sh <surface> <product> <type> to jump straight to its shipped list. For a product with no shipped list, Skill(wiki-arsenal) for its known paths, then cewl its docs / probe robots.txt sitemap.xml swagger.json openapi.json.

Show full SKILL.md (221 more words)Show less

5. Pivot to the parameter axis

When a discovered endpoint takes input, fuzz hidden params: arjun -u https://TARGET/endpoint (see [[arjun]]) or ffuf with bash scripts/wl-pick.sh params. Discovered params feed the hunt-* skills (SSRF/LFI/IDOR/cmdi).

6. WAF / throttle / Cloudflare

Detect: wafw00f/whatwaf up front; headers cf-ray/server: cloudflare/x-sucuri/x-datadome/incapsula; mid-run 429+Retry-After, climbing latency, 000/timeouts, a wall of uniform 403. Respond, in order:

WAF fingerprinted up front -> stealth posture regardless of profile, and PREFER BYPASS over throttle: find the origin IP (cert SANs, historical DNS) and fuzz origin directly - see [[cdn-waf-bypass]].
Throttle mid-run -> auto-backoff: halve rate, add -p 0.1-2.0 jitter, drop one size-tier.
Ban / DoS tell (sustained all-timeout after a burst) -> HARD STOP, do not grind: python3 scripts/campaign.py pause-host <host> and call Skill(redteamlead) for a re-vector rather than tuning the tooling.
RoE no_bruteforce/no_dos -> skip the brute tiers; scope-guard also enforces this at the Bash layer.

7. 403 is not a dead end

A 403 on a discovered dir is a signal, not an end. Try bypass BEFORE abandoning: path mutations (/admin/, /admin/., /admin/..;/, /%2e/admin, case, trailing ?), method swap (GET->POST/HEAD/TRACE), and header spoofs (X-Forwarded-For: 127.0.0.1, X-Original-URL, X-Rewrite-URL). Use a dedicated tool (byp4xx/nomore403) rather than a wordlist - 403 bypass is mutation, not brute. See [[cdn-waf-bypass]].

Wiki

Tools: [[ffuf]] [[wiki/tools/feroxbuster]] [[cewl]] [[arjun]]. Reference: [[wordlists]] (the selection matrix, human-readable twin of wordlist-map.json), [[cdn-waf-bypass]] (WAF/origin bypass). Stuck -> Skill(redteamlead).

Files

Just SKILL.md in skills/workflow/fuzz of Encod3d-Sec/TORCH.

Open the folder on GitHubat commit d21b6c9

Used in 1 other repository

We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in Encod3d-Sec/TORCH, which our catalogue first saw on October 7, 2026.

majiayu000/claude-skill-registryskills/api/fuzz

Compare with similar skills

Adaptive Web Fuzzing next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Adaptive Web Fuzzing compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Adaptive Web Fuzzing this skillEncod3d-Sec/TORCH	329	1 repos	~1.3k	Automated safety check: Pass	MIT	1 mo ago
Metabigor OSINT Reconj3ssie/metabigor	1.8k	—	~2.4k	Automated safety check: Pass	MIT	1 mo ago
Wooyun Legacytanweai/wooyun-legacy	1.8k	—	~1.9k	Automated safety check: Pass	Custom licence	2 mo ago
Client Request Signature Reversalawarexone/Agentic-Bug-Hunter	5.3k	—	~4.7k	Automated safety check: Pass	MIT	2 days ago
Web3 Bug Bounty AI Toolstradecatlabs/vibe-coding-cn	17k	2 repos	~3.9k	Automated safety check: Warn	MIT	6 days ago
Penetration Flowlingbol088-spec/ReiPenFlow	222	—	~1.8k	Automated safety check: Pass	MIT	2 mo ago

Similar skills

Metabigor OSINT Recon
j3ssie/metabigor
Operates the metabigor CLI to map a target's network ranges, subdomains, ports, related domains, CDNs and archived URLs from free sources without API keys.
1.8k GitHub stars~2.4k tokensUpdated 1 mo ago
SecurityAuto-check passed
Wooyun Legacy
tanweai/wooyun-legacy
WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws…
1.8k GitHub stars~1.9k tokensUpdated 2 mo ago
SecurityAuto-check passed
Client Request Signature Reversal
awarexone/Agentic-Bug-Hunter
Recovers a client-side request signature or anti-bot token just far enough to replay blocked requests in bug bounty testing, starting from a captured packet.
5.3k GitHub stars~4.7k tokensUpdated 2 days ago
SecurityAuto-check passed
Web3 Bug Bounty AI Tools
tradecatlabs/vibe-coding-cn
A selection guide to AI-driven tools for Web3 bug bounty work, from autonomous web pentesters to smart contract bug finders, with notes on authorization.
17k GitHub starsUsed in 2 repos~3.9k tokens
SecurityAuto-check: warnings
Penetration Flow
lingbol088-spec/ReiPenFlow
Guided workflow for authorized penetration testing, vulnerability validation, security reporting, CTF/local sandbox reverse engineering, and user-directed vulnerability research.
222 GitHub stars~1.8k tokensUpdated 2 mo ago
SecurityAuto-check passed
Add Partial Recon
samugit83/redamon
Adding partial-recon support for a tool: running a single pipeline phase on demand from the workflow graph, reading its inputs from the existing Neo4j graph and merging results back.
2.9k GitHub stars~1.1k tokensUpdated yesterday
SecurityAuto-check passed

More from Encod3d-Sec/TORCH

All 35 skills in this repo

Bug Bounty Campaign Driver
Encod3d-Sec/TORCH
Runs a bug-bounty engagement through a script that tracks the current pass, builds a board of rows from recon and prints the next required action each turn.
329 GitHub starsUsed in 1 repo~1.8k tokens
Auto-check passed
Hunt Idor
Encod3d-Sec/TORCH
IDOR / BOLA hunting - two-account methodology, identifier discovery and UUID leak chaining, the trusted-identifier test, GraphQL node and nested-object IDOR, cross-tenant escalation, write and…
329 GitHub starsUsed in 1 repo~2.6k tokens
Auto-check passed
Campaign Workflow Health Check
Encod3d-Sec/TORCH
Checks that the bb, pt and ctf workflow driver is set up correctly on a machine: vault content, skill symlinks, hooks, imports and a live smoke test, with fixes for failures.
329 GitHub stars~611 tokensUpdated 1 mo ago
Auto-check passed
Visible Browser for Manual Login Capture
Encod3d-Sec/TORCH
Opens a visible Chromium window on a Kali VM so an operator can complete a manual login or CAPTCHA while the agent watches and acts through the chrome-devtools MCP.
329 GitHub stars~1.2k tokensUpdated 1 mo ago
Auto-check passed
CTF Campaign Driver
Encod3d-Sec/TORCH
Runs a capture-the-flag box from first scan to root with a driver script that tracks progress and prints the next action each turn.
329 GitHub stars~1.8k tokensUpdated 1 mo ago
Auto-check passed
Sub-Agent Exploit-Run Delegation
Encod3d-Sec/TORCH
Decides when a main pentesting agent should hand a fully-specified, mechanical exploit-compile or privilege-escalation step to a cheaper sub-agent, and how to specify that handoff safely.
329 GitHub stars~1.6k tokensUpdated 1 mo ago
Auto-check: notes

Questions about Adaptive Web Fuzzing

What does Adaptive Web Fuzzing do?

Adaptive web fuzzing for pentests, bug bounty and CTF work: picks the smallest suitable SecLists wordlist per target surface and calibrates filters against soft-404 responses. md and sets a profile. The ctf profile runs loud and fast, pt uses a calibrated rate and obeys rules-of-engagement flags such as no_bruteforce and no_dos by skipping the brute-force tiers, and bb runs at a low rate with jitter while watching for a ban.

When should I use Adaptive Web Fuzzing?

Adaptive Web Fuzzing fits situations like: running content or vhost discovery against a web target in a security engagement; looking for hidden parameters on an endpoint that accepts input; choosing which wordlist to run next for a given surface.

How do I install Adaptive Web Fuzzing in Claude Code?

Run `npx skills add Encod3d-Sec/TORCH --skill fuzz -a claude-code`. Or copy the skill folder (skills/workflow/fuzz in Encod3d-Sec/TORCH) into .claude/skills/fuzz in your project. Claude Code loads it when a task matches its description.

How do I install Adaptive Web Fuzzing in Codex?

Run `npx skills add Encod3d-Sec/TORCH --skill fuzz -a codex`. Or copy the skill folder (skills/workflow/fuzz in Encod3d-Sec/TORCH) into .agents/skills/fuzz in your project. Codex loads it when a task matches its description.

Can I use Adaptive Web Fuzzing in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Encod3d-Sec/TORCH --skill fuzz -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/fuzz, .gemini/skills/fuzz, .github/skills/fuzz and .opencode/skills/fuzz in your project.

What does Adaptive Web Fuzzing need to run?

Going by SKILL.md and its folder, Adaptive Web Fuzzing needs the command-line tools its instructions call (bash and python3). Our summary lists: ffuf, gobuster, feroxbuster, cewl or arjun; SecLists wordlists; The wl-pick.sh script and a target state.md file.

Does Adaptive Web Fuzzing access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Adaptive Web Fuzzing safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Adaptive Web Fuzzing use?

Adaptive Web Fuzzing is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Adaptive Web Fuzzing use?

About 1.3k tokens (SKILL.md is roughly 5.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Adaptive Web Fuzzing?

Skills that share tags, products or a category with Adaptive Web Fuzzing: Metabigor OSINT Recon (j3ssie/metabigor, 1.8k stars), Wooyun Legacy (tanweai/wooyun-legacy, 1.8k stars), Client Request Signature Reversal (awarexone/Agentic-Bug-Hunter, 5.3k stars) and Web3 Bug Bounty AI Tools (tradecatlabs/vibe-coding-cn, 17k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Adaptive Web Fuzzing?

Encod3d-Sec (a GitHub user) maintains it in Encod3d-Sec/TORCH, which has 329 GitHub stars. The repository holds 35 skills in this directory. The repository was last updated on September 1, 2026.

Source: Encod3d-Sec/TORCH on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Adaptive Web Fuzzing

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

fuzz - adaptive web fuzzing

0. Profile (do this first)

1. Two axes

2. Select (deterministic) - always via wl-pick.sh

3. Calibrate (native first, backstop with judgment)

4. Climb tiers on SIGNAL (the adaptive core)

5. Pivot to the parameter axis

6. WAF / throttle / Cloudflare

7. 403 is not a dead end

Wiki

Files

Used in 1 other repository

Compare with similar skills

Similar skills

More from Encod3d-Sec/TORCH

Related

Questions about Adaptive Web Fuzzing