Agent skill

Patt Fetcher

by transilienceai in transilienceai/communitytools

Fetches and extracts payloads from PayloadsAllTheThings on demand.

MITAuto-check passedSecurity

Install Patt Fetcher

skills CLI
$ npx skills add transilienceai/communitytools --skill patt-fetcher -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install transilienceai/communitytools patt-fetcher --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/patt-fetcher .claude/skills/patt-fetcher && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
patt-fetcher
GitHub stars
563
Token cost
~1.3k tokens
SKILL.md length
174 words
Files
1
Skills in repo
35
Repo updated
First seen
Licence
MIT

At a glance

Fetches and extracts payloads from PayloadsAllTheThings on demand.

  • Works in 4 steps: Match category to URL Map… → WebFetch the raw URL → Find first H2 heading matching query →… → …
  • Security work in your project
  • SKILL.md covers URL Map, Workflow and Error Handling
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Patt Fetcher is an agent skill from transilienceai/communitytools. Fetches and extracts payloads from PayloadsAllTheThings on demand. Bake into executor prompts for live payload enrichment.

Its SKILL.md is about 1.3k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security. It works with Linux. The repository describes itself as: Open-source Claude Code skills, agents, and slash commands for AI-powered penetration testing, bug bounty hunting, and security research. The licence is MIT.

When your agent uses it

  • Security work in your project

Example prompts

  • “Use the patt-fetcher skill to fetch and extracts payloads from PayloadsAllTheThings on demand”
  • “/patt-fetcher”

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. Match category to URL Map (case-insensitive)
  2. WebFetch the raw URL
  3. Find first H2 heading matching query → return up to 100 lines
  4. Return extracted payloads to caller

What it can do on your machine

Read from SKILL.md and the folder at commit 95fdc12. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • raw.githubusercontent.com
    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Patt Fetcher loads about 1.3k tokens when it runs. Until then it costs about 34 tokens; SKILL.md has 174 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~34
When it runs · the whole SKILL.md, loaded when a task matches
~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from transilienceai/communitytools at commit 95fdc12, republished under its MIT licence (© transilienceai). 174 words, ~1,289 tokens.

Download SKILL.mdSave it as .claude/skills/patt-fetcher/SKILL.md (or your agent's skills folder).
name
patt-fetcher
description
Fetches and extracts payloads from PayloadsAllTheThings on demand. Bake into executor prompts for live payload enrichment.

PATT Fetcher

Fetches payloads from PayloadsAllTheThings on demand. Use model="haiku" when spawning for lightweight operation.

URL Map

CategoryRaw URL
SQL Injectionhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/SQL%20Injection/README.md
XSShttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/XSS%20Injection/README.md
Command Injectionhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Command%20Injection/README.md
SSTIhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Server%20Side%20Template%20Injection/README.md
XXEhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/XXE%20Injection/README.md
SSRFhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Server%20Side%20Request%20Forgery/README.md
Path Traversalhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Directory%20Traversal/README.md
File Inclusionhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/File%20Inclusion/README.md
LDAP Injectionhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/LDAP%20Injection/README.md
NoSQL Injectionhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/NoSQL%20Injection/README.md
Active Directoryhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md
Linux PrivEschttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation.md
Windows PrivEschttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation.md
Reverse Shellshttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
Linux Persistencehttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Linux%20-%20Persistence.md
Windows Persistencehttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Windows%20-%20Persistence.md
Linux Evasionhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Linux%20-%20Evasion.md
Windows Evasionhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Windows%20-%20AMSI%20Bypass.md
Hash Crackinghttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Hash%20Cracking.md
Network Pivotinghttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Network%20Pivoting%20Techniques.md
Mass Assignmenthttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Mass%20Assignment/README.md
Open Redirecthttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Open%20Redirect/README.md
OAuth Misconfighttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/OAuth%20Misconfiguration/README.md
SAML Injectionhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/SAML%20Injection/README.md
CORS Misconfighttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/CORS%20Misconfiguration/README.md
Race Conditionhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Race%20Condition/README.md
Prototype Pollutionhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Prototype%20Pollution/README.md
Type Jugglinghttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Type%20Juggling/README.md
Deserializationhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Insecure%20Deserialization/README.md
GraphQLhttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/GraphQL%20Injection/README.md
AWShttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Cloud%20-%20AWS%20Pentest.md
Azurehttps://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md

Workflow

  1. Match category to URL Map (case-insensitive)
  2. WebFetch the raw URL
  3. Find first H2 heading matching query → return up to 100 lines
  4. Return extracted payloads to caller

Error Handling

  • 404: PATT may have restructured — check https://github.com/swisskyrepo/PayloadsAllTheThings
  • Rate limit: Back off and retry; if persistent, note the category as unavailable and proceed with built-in payloads
  • Unknown category: Ask caller for direct raw URL

© transilienceai, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/patt-fetcher of transilienceai/communitytools.

Open the folder on GitHubat commit 95fdc12

Compare with similar skills

Patt Fetcher next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Patt Fetcher compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Patt Fetcher this skilltransilienceai/communitytools563—~1.3kAutomated safety check: PassMIT
Write Cve Ruleevdenis/cvehound138—~2.5kAutomated safety check: PassGPL-3.0
Securitystatic-web-server/static-web-server2.4k—~2kAutomated safety check: NotesApache-2.0
User Managementsickn33/agentic-awesome-skills47k2 repos~2.8kAutomated safety check: NotesMIT
Configuring Host Based Intrusion Detectionmukul975/Anthropic-Cybersecurity-Skills34k—~2.1kAutomated safety check: PassApache-2.0
Configuring Zscaler Private Access For Ztnamukul975/Anthropic-Cybersecurity-Skills34k—~2.9kAutomated safety check: NotesApache-2.0

Similar skills

  • Write Cve Rule

    evdenis/cvehound

    Write, debug, or validate a CVEhound detection rule (.cocci or .grep) for a Linux kernel CVE.

    138 GitHub stars~2.5k tokensUpdated 2 days ago
    SecurityAuto-check passed
  • Security

    static-web-server/static-web-server

    Review or implement security-sensitive code in the Static Web Server (SWS) project — path traversal defenses, symlink and hidden-file policy, TLS, security headers, CORS, basic auth, untrusted input…

    2.4k GitHub stars~2k tokensUpdated yesterday
    SecurityAuto-check: notes
  • User Management

    sickn33/agentic-awesome-skills

    Manage users, groups, and permissions on Linux systems. An agent skill from sickn33/agentic-awesome-skills.

    47k GitHub starsUsed in 2 repos~2.8k tokens
    SecurityAuto-check: notes
  • Configuring Host Based Intrusion Detection

    mukul975/Anthropic-Cybersecurity-Skills

    Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations.

    34k GitHub stars~2.1k tokensUpdated 1 mo ago
    SecurityAuto-check passed
  • Configuring Zscaler Private Access For Ztna

    mukul975/Anthropic-Cybersecurity-Skills

    Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring identity- and…

    34k GitHub stars~2.9k tokensUpdated 1 mo ago
    SecurityAuto-check: notes
  • Detecting Secure Boot Bypass

    mukul975/Anthropic-Cybersecurity-Skills

    Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries against known-bad sets…

    34k GitHub stars~2.6k tokensUpdated 1 mo ago
    SecurityAuto-check: notes

More from transilienceai/communitytools

All 35 skills in this repo
  • Dfir

    transilienceai/communitytools

    Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.

    563 GitHub stars~1.5k tokensUpdated 2 mo ago
    Auto-check passed
  • GitHub Workflow

    transilienceai/communitytools

    GitHub workflow automation — branching, committing, pushing, pull requests, issues, and code review.

    563 GitHub stars~812 tokensUpdated 2 mo ago
    Auto-check: notes
  • Pci Secure Software

    transilienceai/communitytools

    Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation.

    563 GitHub stars~1.8k tokensUpdated 2 mo ago
    Auto-check passed
  • Protect With Password

    transilienceai/communitytools

    Generate ONE strong password and apply it to each referenced file (PDF, Word, Excel, PowerPoint, or any type).

    563 GitHub stars~583 tokensUpdated 2 mo ago
    Auto-check passed
  • Skill Update

    transilienceai/communitytools

    Skill creation, update and management — generates skill directory structure, validates against best practices, enforces line count limits.

    563 GitHub stars~1.2k tokensUpdated 2 mo ago
    Auto-check passed
  • Source Code Scanning

    transilienceai/communitytools

    Security-focused source code review and SAST. An agent skill from transilienceai/communitytools.

    563 GitHub stars~1.2k tokensUpdated 2 mo ago
    Auto-check: notes

Works with

Categories

Questions about Patt Fetcher

What does Patt Fetcher do?

Fetches and extracts payloads from PayloadsAllTheThings on demand. Patt Fetcher is an agent skill from transilienceai/communitytools. Fetches and extracts payloads from PayloadsAllTheThings on demand.

When should I use Patt Fetcher?

Patt Fetcher fits situations like: security work in your project.

How do I install Patt Fetcher in Claude Code?

Run `npx skills add transilienceai/communitytools --skill patt-fetcher -a claude-code`. Or copy the skill folder (skills/patt-fetcher in transilienceai/communitytools) into .claude/skills/patt-fetcher in your project. Claude Code loads it when a task matches its description.

How do I install Patt Fetcher in Codex?

Run `npx skills add transilienceai/communitytools --skill patt-fetcher -a codex`. Or copy the skill folder (skills/patt-fetcher in transilienceai/communitytools) into .agents/skills/patt-fetcher in your project. Codex loads it when a task matches its description.

Can I use Patt Fetcher in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add transilienceai/communitytools --skill patt-fetcher -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/patt-fetcher, .gemini/skills/patt-fetcher, .github/skills/patt-fetcher and .opencode/skills/patt-fetcher in your project.

What does Patt Fetcher need to run?

SKILL.md names no scripts, command-line tools or credentials: Patt Fetcher is instructions for the agent only.

Does Patt Fetcher access the network?

SKILL.md names 2 domains. As links in the text: raw.githubusercontent.com and github.com. This is read from the text; nothing was executed.

Is Patt Fetcher safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Patt Fetcher use?

Patt Fetcher is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Patt Fetcher use?

About 1.3k tokens (SKILL.md is roughly 5.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Patt Fetcher?

Skills that share tags, products or a category with Patt Fetcher: Write Cve Rule (evdenis/cvehound, 138 stars), Security (static-web-server/static-web-server, 2.4k stars), User Management (sickn33/agentic-awesome-skills, 47k stars) and Configuring Host Based Intrusion Detection (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Patt Fetcher?

transilienceai (a GitHub organization) maintains it in transilienceai/communitytools, which has 563 GitHub stars. The repository holds 35 skills in this directory. The repository was last updated on July 29, 2026.

Source: transilienceai/communitytools on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.