Code Audit
3stoneBrother/code-audit
Professional code security audit skill covering 55+ vulnerability types.
Detect and exploit local and remote file inclusion vulnerabilities for sensitive data access and code execution
Install File Inclusion
The automated check flagged lines worth reading first. See the safety section below.
$ npx skills add NeoTheCapt/RedteamAgent --skill file-inclusion -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install NeoTheCapt/RedteamAgent file-inclusion --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/NeoTheCapt/RedteamAgent.git skills-src && mkdir -p .claude/skills && cp -r skills-src/agent/skills/file-inclusion .claude/skills/file-inclusion && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "file-inclusion" agent skill from https://github.com/NeoTheCapt/RedteamAgent/tree/master/agent/skills/file-inclusion into .claude/skills/file-inclusion/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "file-inclusion", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/NeoTheCapt/RedteamAgent/tree/master/agent/skills/file-inclusionType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add NeoTheCapt/RedteamAgent --skill file-inclusion -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install NeoTheCapt/RedteamAgent file-inclusion --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/NeoTheCapt/RedteamAgent.git skills-src && mkdir -p .agents/skills && cp -r skills-src/agent/skills/file-inclusion .agents/skills/file-inclusion && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "file-inclusion" agent skill from https://github.com/NeoTheCapt/RedteamAgent/tree/master/agent/skills/file-inclusion into .agents/skills/file-inclusion/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "file-inclusion", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add NeoTheCapt/RedteamAgent --skill file-inclusion -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install NeoTheCapt/RedteamAgent file-inclusion --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/NeoTheCapt/RedteamAgent.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/agent/skills/file-inclusion .cursor/skills/file-inclusion && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "file-inclusion" agent skill from https://github.com/NeoTheCapt/RedteamAgent/tree/master/agent/skills/file-inclusion into .cursor/skills/file-inclusion/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "file-inclusion", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/NeoTheCapt/RedteamAgent.git --path agent/skills/file-inclusion--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add NeoTheCapt/RedteamAgent --skill file-inclusion -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install NeoTheCapt/RedteamAgent file-inclusion --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/NeoTheCapt/RedteamAgent.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/agent/skills/file-inclusion .gemini/skills/file-inclusion && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "file-inclusion" agent skill from https://github.com/NeoTheCapt/RedteamAgent/tree/master/agent/skills/file-inclusion into .gemini/skills/file-inclusion/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "file-inclusion", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install NeoTheCapt/RedteamAgent file-inclusionInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add NeoTheCapt/RedteamAgent --skill file-inclusion -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/NeoTheCapt/RedteamAgent.git skills-src && mkdir -p .github/skills && cp -r skills-src/agent/skills/file-inclusion .github/skills/file-inclusion && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "file-inclusion" agent skill from https://github.com/NeoTheCapt/RedteamAgent/tree/master/agent/skills/file-inclusion into .github/skills/file-inclusion/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "file-inclusion", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add NeoTheCapt/RedteamAgent --skill file-inclusion -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install NeoTheCapt/RedteamAgent file-inclusion --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/NeoTheCapt/RedteamAgent.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/agent/skills/file-inclusion .opencode/skills/file-inclusion && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "file-inclusion" agent skill from https://github.com/NeoTheCapt/RedteamAgent/tree/master/agent/skills/file-inclusion into .opencode/skills/file-inclusion/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "file-inclusion", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
file-inclusion- GitHub stars
- 142
- Token cost
- ~988 tokens
- SKILL.md length
- 96 words
- Files
- 1
- Skills in repo
- 25
- Repo updated
- First seen
- Licence
- None found
At a glance
Detect and exploit local and remote file inclusion vulnerabilities for sensitive data access and code execution
- Tasks that involve Penetration testing
- SKILL.md covers When to Activate, LFI Detection, Sensitive Files and PHP Wrappers, plus 2 more sections
- Calls ssh and python3
What it does
File Inclusion is an agent skill from NeoTheCapt/RedteamAgent. Detect and exploit local and remote file inclusion vulnerabilities for sensitive data access and code execution
Its SKILL.md is about 990 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Penetration testing. It works with PHP. The repository describes itself as: An AI red-team agent for authorized labs and web app pentesting workflows. Turns Claude Code / OpenCode / Codex into a structured recon → test → exploit → report workflow, with…
When your agent uses it
- Tasks that involve Penetration testing
Example prompts
- “/file-inclusion”
Requirements
- Python 3
What it can do on your machine
Read from SKILL.md and the folder at commit 2e60476. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
sshpython3
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use ssh, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
File Inclusion loads about 988 tokens when it runs. Until then it costs about 32 tokens; SKILL.md has 96 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: warnings
The automated check found patterns that need a careful read before installing.
- WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:50
fd/0-20, /proc/net/tcp, /home/USER/.ssh/id_rsa - NoteMentions a .env fileSKILL.md:57
/var/www/html/config.php, /var/www/html/.env - NoteMentions a .env fileSKILL.md:58
/var/www/html/wp-config.php, .env, config.php, config.yml, database.yml, settings.py
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Without a licence we can't republish the file, so here is its outline and opening line. It has 96 words (~988 tokens).
- name
- file-inclusion
- origin
- RedteamOpencode
Files
Just SKILL.md in agent/skills/file-inclusion of NeoTheCapt/RedteamAgent.
Open the folder on GitHubat commit 2e60476
Compare with similar skills
File Inclusion next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| File Inclusion this skillNeoTheCapt/RedteamAgent | 142 | — | ~988 | Automated safety check: Warn | None | |
| Code Audit3stoneBrother/code-audit | 892 | 1 repos | ~2.7k | Automated safety check: Pass | None | |
| SstiPentesterFlow/agent | 1.4k | — | ~1.2k | Automated safety check: Pass | Apache-2.0 | |
| Insecure Deserialization PlaybookPentesterFlow/agent | 1.4k | — | ~1.7k | Automated safety check: Pass | Apache-2.0 | |
| Kantor Agenthumaedihume/kantor-agent | 101 | — | ~1k | Automated safety check: Pass | MIT | |
| Fix Strix Security Findingsusestrix/strix | 67k | — | ~1.5k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Ssti
PentesterFlow/agent
Server-Side Template Injection — fingerprint the engine first (Jinja2 / Twig / Velocity / Freemarker / ERB / Smarty / Mako / Handlebars / Pug), then escalate the engine-specific primitive to RCE or…
Insecure Deserialization Playbook
PentesterFlow/agent
Fingerprints which language or framework produced a serialized blob, then helps build a working gadget chain to test for insecure deserialization.
Kantor Agent
humaedihume/kantor-agent
Jalankan "Kantor Agent" — kantor 3D (three.js) tanpa konfigurasi di http://127.0.0.1:8788/kerja yang menampilkan apa yang sedang dikerjakan Claude di project ini.
Fix Strix Security Findings
usestrix/strix
Triages findings from a Strix pentest by severity, fixes each root cause with a minimal change, and re-runs Strix to confirm the exploit no longer works.
Audit Skills
RuoJi6/audit-skills
当用户要求审计 Java、.NET 或 PHP 源码/部署产物/反编译产物/安全发现，并需要默认脚本输出目录、报告输出目录、Java/.NET 反编译与反混淆参考、Java 组件 YAML 正则匹配扫描、确认漏洞判定标准、安全 Payload 和 BurpSuite 原始 HTTP 请求包证据时使用。仅用于授权代码审计和防御性安全验证。
More from NeoTheCapt/RedteamAgent
All 25 skills in this repoAuth Bypass
NeoTheCapt/RedteamAgent
Test for authentication and authorization flaws including credential attacks, session issues, and access control bypasses
Business Logic Testing
NeoTheCapt/RedteamAgent
Business logic vulnerability detection — workflow bypass, price manipulation, state abuse, and application-specific flaws
Cors Testing
NeoTheCapt/RedteamAgent
CORS misconfiguration testing for data theft and access control bypass
Csrf Testing
NeoTheCapt/RedteamAgent
Cross-site request forgery testing for state-changing operations
Deserialization Testing
NeoTheCapt/RedteamAgent
Insecure deserialization detection and gadget chain exploitation
Directory Fuzzing
NeoTheCapt/RedteamAgent
Discover hidden directories, files, and endpoints on a web server
Related
Works with
Categories
Questions about File Inclusion
What does File Inclusion do?
Detect and exploit local and remote file inclusion vulnerabilities for sensitive data access and code execution. File Inclusion is an agent skill from NeoTheCapt/RedteamAgent.
When should I use File Inclusion?
File Inclusion fits situations like: tasks that involve Penetration testing.
How do I install File Inclusion in Claude Code?
Run `npx skills add NeoTheCapt/RedteamAgent --skill file-inclusion -a claude-code`. Or copy the skill folder (agent/skills/file-inclusion in NeoTheCapt/RedteamAgent) into .claude/skills/file-inclusion in your project. Claude Code loads it when a task matches its description.
How do I install File Inclusion in Codex?
Run `npx skills add NeoTheCapt/RedteamAgent --skill file-inclusion -a codex`. Or copy the skill folder (agent/skills/file-inclusion in NeoTheCapt/RedteamAgent) into .agents/skills/file-inclusion in your project. Codex loads it when a task matches its description.
Can I use File Inclusion in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add NeoTheCapt/RedteamAgent --skill file-inclusion -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/file-inclusion, .gemini/skills/file-inclusion, .github/skills/file-inclusion and .opencode/skills/file-inclusion in your project.
What does File Inclusion need to run?
Going by SKILL.md and its folder, File Inclusion needs the command-line tools its instructions call (ssh and python3). Our summary lists: Python 3.
Does File Inclusion access the network?
SKILL.md contains no URLs. Its commands use ssh, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is File Inclusion safe to install?
Our automated static check of SKILL.md flagged 1 warning(s): mentions a credentials file (ssh keys, cloud or package-manager tokens). Read the flagged lines before installing; the check is not a guarantee either way.
What licence does File Inclusion use?
No licence was found for File Inclusion or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.
How many tokens does File Inclusion use?
About 988 tokens (SKILL.md is roughly 4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to File Inclusion?
Skills that share tags, products or a category with File Inclusion: Code Audit (3stoneBrother/code-audit, 892 stars), Ssti (PentesterFlow/agent, 1.4k stars), Insecure Deserialization Playbook (PentesterFlow/agent, 1.4k stars) and Kantor Agent (humaedihume/kantor-agent, 101 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains File Inclusion?
NeoTheCapt (a GitHub user) maintains it in NeoTheCapt/RedteamAgent, which has 142 GitHub stars. The repository holds 25 skills in this directory. The repository was last updated on August 2, 2026.
Source: NeoTheCapt/RedteamAgent on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.