Agent skill

Injection Vulns

当发现参数拼接SQL、动态排序/筛选、JSON查询条件可控、模板渲染、命令执行点、搜索/统计/自动补全接口时调用，进行SQL/NoSQL/命令/SSTI/表达式注入的深度挖掘。命中场景：搜索框、排序参数、登录绕过、导出条件、文件名参数、模板/报表生成、爬虫URL参数。

MITAuto-check passedDatabases

Install Injection Vulns

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill injection-vulns -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS injection-vulns --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/injection-vulns .claude/skills/injection-vulns && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "injection-vulns" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/injection-vulns into .claude/skills/injection-vulns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "injection-vulns", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/injection-vulns

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill injection-vulns -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS injection-vulns --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/injection-vulns .agents/skills/injection-vulns && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "injection-vulns" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/injection-vulns into .agents/skills/injection-vulns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "injection-vulns", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill injection-vulns -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS injection-vulns --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/injection-vulns .cursor/skills/injection-vulns && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "injection-vulns" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/injection-vulns into .cursor/skills/injection-vulns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "injection-vulns", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/zhaji2333/CkSKILLS.git --path .agents/skills/injection-vulns

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill injection-vulns -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS injection-vulns --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/injection-vulns .gemini/skills/injection-vulns && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "injection-vulns" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/injection-vulns into .gemini/skills/injection-vulns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "injection-vulns", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS injection-vulns

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill injection-vulns -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/injection-vulns .github/skills/injection-vulns && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "injection-vulns" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/injection-vulns into .github/skills/injection-vulns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "injection-vulns", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill injection-vulns -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS injection-vulns --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/injection-vulns .opencode/skills/injection-vulns && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "injection-vulns" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/injection-vulns into .opencode/skills/injection-vulns/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "injection-vulns", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: injection-vulns
GitHub stars: 115
Token cost: ~579 tokens
SKILL.md length: 122 words
Files: 1
Skills in repo: 15
Repo updated: Sep 15, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Tasks that involve NoSQL databases
SKILL.md covers 何时调用（触发条件）, 一、漏洞类型全景, 二、常见场景清单（搜索/查询类） and 三、接口 Fuzz 技巧（参数污染与类型混淆）, plus 5 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
Tasks that involve SQL

What it does

Injection Vulns is an agent skill from zhaji2333/CkSKILLS. 当发现参数拼接SQL、动态排序/筛选、JSON查询条件可控、模板渲染、命令执行点、搜索/统计/自动补全接口时调用，进行SQL/NoSQL/命令/SSTI/表达式注入的深度挖掘。命中场景：搜索框、排序参数、登录绕过、导出条件、文件名参数、模板/报表生成、爬虫URL参数。

Its SKILL.md is about 580 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Databases, covering NoSQL databases and SQL. It works with SQL. The repository describes itself as: 基于 Claude Code / Codex 的 SRC 漏洞挖掘 Agent 技能体系 —— 将顶尖安全研究员的方法论沉淀为可调度、可复用的 Skill 知识资产。 The licence is MIT.

When your agent uses it

Tasks that involve NoSQL databases
Tasks that involve SQL

Example prompts

“/injection-vulns”

What it can do on your machine

Read from SKILL.md and the folder at commit 482fe78. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Injection Vulns loads about 579 tokens when it runs. Until then it costs about 38 tokens; SKILL.md has 122 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~38
When it runs · the whole SKILL.md, loaded when a task matches: ~579

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from zhaji2333/CkSKILLS at commit 482fe78, republished under its MIT licence (© zhaji2333). 122 words, ~579 tokens.

Download SKILL.mdSave it as .claude/skills/injection-vulns/SKILL.md (or your agent's skills folder).

name: injection-vulns
description: 当发现参数拼接SQL、动态排序/筛选、JSON查询条件可控、模板渲染、命令执行点、搜索/统计/自动补全接口时调用，进行SQL/NoSQL/命令/SSTI/表达式注入的深度挖掘。命中场景：搜索框、排序参数、登录绕过、导出条件、文件名参数、模板/报表生成、爬虫URL参数。

injection-vulns — 注入类漏洞专项深度挖掘

何时调用（触发条件）

参数直接拼接到 SQL / NoSQL 查询（搜索、筛选、排序、分页、导出条件）
JSON 查询条件可控（{"$gt":0} 等 MongoDB 风格）
用户输入进入 shell 命令（exec/system/ProcessBuilder、ping/curl/文件名拼接）
用户输入进入模板引擎（Jinja2/Velocity/Freemarker/Thymeleaf）
用户输入进入表达式解释器（SpEL/OGNL/EL/MVEL）
危险函数出现在代码审计结果中（见 source-code-audit）

一、漏洞类型全景

类型	危险函数/场景	挖掘要点
C1. SQL注入	拼接SQL、动态排序	响应差异验证（错误/延迟/条数）
C2. NoSQL注入	JSON查询条件可控	类型替换、全量查询
C3. 命令注入	exec/system/ProcessBuilder	shell拼接、管道符
C4. 模板注入（SSTI）	Jinja2/Velocity/Freemarker	用户输入进入模板渲染
C5. 表达式注入	SpEL/OGNL/EL	可控片段进入解释器

二、常见场景清单（搜索/查询类）

场景	漏洞类型	挖掘要点
站内搜索	SQL注入/XSS/信息泄露	搜索词拼接、搜索结果反射
高级筛选/排序	SQL注入/NoSQL注入	order by注入、筛选条件可控
自动补全/联想	信息泄露/用户枚举	补全接口泄露敏感数据
数据统计/图表	SQL注入/越权	统计维度可控、跨权限聚合
ES/Solr搜索	查询注入/未授权	DSL注入、搜索接口暴露

三、接口 Fuzz 技巧（参数污染与类型混淆）

参数污染：
  ?id=1&id=2  → 看哪个生效
  ?id[]=1&id[]=2 → 数组化
  ?id=1,2,3 → 批量查询

类型混淆：
  id=1 → id="1" → id={"$gt":0} → id[]=1

编码绕过：
  Unicode: \u002e\u002e/ (../)
  双重URL编码: %252e%252e%252f

隐藏参数：
  debug=1 / test=1 / admin=1
  _method=PUT / X-HTTP-Method-Override

批量操作：
  ids=1,2,3,4,5 一次查多个
  page=-1 / limit=99999 绕过分页

四、SQL 注入绕过技术

大小写：SeLeCt / 双写：selselectect
注释：/**/、/*!*/、--+、#
编码：URL编码、十六进制、Unicode
等价函数：substr→mid、ascii→ord

五、命令注入绕过技术

分隔符：| / || / & / && / ; / %0a
空格：${IFS} / $IFS$9 / %09 / {cat,/etc/passwd}
通配符：/???/??t /etc/passwd

六、验证要点

响应差异对比：基线请求 vs 注入请求的状态码/响应大小/错误信息/响应时间
时间盲注：SLEEP(5) / pg_sleep(5) / WAITFOR DELAY '0:0:5' 验证
报错注入：updatexml / extractvalue / 类型转换错误
NoSQL：{"$ne":null}、{"$where":"1==1"}、数组/类型替换
SSTI：{{7*7}}、${7*7}、<%= 7*7 %> 探测
命令注入：id、whoami、DNSLog 外带
所有注入点至少尝试到 Level 4 绕过（见 CLAUDE.md 1.1 第五节）

七、修复建议

SQL：预编译/参数化查询，动态排序用白名单映射
NoSQL：禁止 $ 运算符进入查询条件，类型强校验
命令：白名单命令 + 参数数组传递，禁止 shell 拼接
SSTI：模板引擎关闭危险特性（Jinja2 禁用 __class__ 链）
表达式：禁止用户可控片段进入 SpEL/OGNL/EL 解释器

八、输出与报告要点

完整 PoC（curl 命令），标注注入点参数与 payload
差异对比证据（基线响应 vs 注入响应）
影响面：可读取的库表、可执行的命令、可拿到的数据量
根因分析：输入点 → 传播链 → Sink

Files

Just SKILL.md in .agents/skills/injection-vulns of zhaji2333/CkSKILLS.

Open the folder on GitHubat commit 482fe78

Compare with similar skills

Injection Vulns next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Injection Vulns compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Injection Vulns this skillzhaji2333/CkSKILLS	115	—	~579	Automated safety check: Pass	MIT	26 days ago
Database Architecture InterviewerPrepLabsAI/InterviewMentor	112	—	~2.4k	Automated safety check: Pass	MIT	4 days ago
Injectiontransilienceai/communitytools	563	—	~424	Automated safety check: Pass	MIT	2 mo ago
Databaseaiskillstore/marketplace	433	3 repos	~1.2k	Automated safety check: Pass	None	yesterday
AWS Storageaws/agent-toolkit-for-aws	2.8k	—	~5.8k	Automated safety check: Pass	Apache-2.0	yesterday
Database FundamentalsDanielPodolsky/ownyourcode	290	1 repos	~1.6k	Automated safety check: Pass	MIT	3 mo ago

Similar skills

Database Architecture Interviewer
PrepLabsAI/InterviewMentor
A Principal Database Engineer interviewer. An agent skill from PrepLabsAI/InterviewMentor.
112 GitHub stars~2.4k tokensUpdated 4 days ago
DatabasesAuto-check passed
Injection
transilienceai/communitytools
Injection vulnerability testing - SQL, NoSQL, OS Command, SSTI, XXE, and LDAP/XPath injection techniques.
563 GitHub stars~424 tokensUpdated 2 mo ago
DatabasesAuto-check passed
Database
aiskillstore/marketplace
Database development and operations workflow covering SQL, NoSQL, database design, migrations, optimization, and data engineering.
433 GitHub starsUsed in 3 repos~1.2k tokens
DatabasesAuto-check passed
AWS Storage
aws/agent-toolkit-for-aws
Official
Selects, investigates, and compares AWS object, file, and block storage services, and answers cost, performance, configuration, security, and troubleshooting questions about storage services.
2.8k GitHub stars~5.8k tokensUpdated yesterday
DatabasesAuto-check passed
Database Fundamentals
DanielPodolsky/ownyourcode
Reviews schema design, SQL queries, ORM patterns. An agent skill from DanielPodolsky/ownyourcode.
290 GitHub starsUsed in 1 repo~1.6k tokens
DatabasesAuto-check passed
Postgresql Best Practices Cloudbase
TencentCloudBase/CloudBase-AI-Toolkit
CloudBase PostgreSQL access-pattern and slow-query quality guidance.
1.1k GitHub starsUsed in 1 repo~1.3k tokens
DatabasesAuto-check passed

More from zhaji2333/CkSKILLS

All 15 skills in this repo

Apk Reversing
zhaji2333/CkSKILLS
当需要获取目标 APK、识别加固壳类型、脱壳还原 dex、反编译得到 Java/so/H5 全量源码产物，或 android-security-audit 需要可直接开挖的输入时调用。负责 APK → 全量可审计产物（壳识别 → 脱壳 → JADX 反编译 + apktool 资源 + so 提取 + H5/assets 提取）→ 标准目录交付。命中场景：JADX 打开是…
115 GitHub stars~1.7k tokensUpdated 26 days ago
Auto-check passed
Asc Fast Hunt
zhaji2333/CkSKILLS
当需要在不对 APK 全量反编译的前提下秒级定位硬编码密钥/签名函数/隐藏接口/调试后门，或 APK 过大（100MB）JADX 全量反编译过慢、内存吃紧，或脱壳产物（裸 dex）需要快速检索，或只想先读一下 Manifest 组件面/权限清单时调用。负责基于 Droid ASC 的零预处理快速定位（findrefs 全局交叉引用搜索 + getclass 按需反编译 + Manifest…
115 GitHub stars~3.3k tokensUpdated 26 days ago
Auto-check passed
Business Logic Race
zhaji2333/CkSKILLS
当目标存在支付/下单/退款/提现/转账/优惠券/积分/红包/会员/订阅/审批/库存/抽奖等业务功能，或发现状态可跳变、金额参数可控、并发可重放时调用。负责业务状态机建模、金额篡改、订单状态跳变、竞态条件与重放攻击深度挖掘。
115 GitHub stars~466 tokensUpdated 26 days ago
Auto-check passed
AI LLM Agent Security
zhaji2333/CkSKILLS
当目标为 LLM 应用/Chatbot/智能客服/AI 助手/Copilot/Agent/RAG 知识库/多模态模型，或发现用户输入进入大模型提示、工具调用、知识库检索、对话记忆、文件解析，或需要测试提示词注入/越狱逃逸/System Prompt 泄露/训练数据与敏感信息泄露/RAG 检索污染/Agent 记忆污染/工具滥用与命令执行/SSRF/沙箱逃逸时调用。负责 OWASP LLM…
115 GitHub stars~4.7k tokensUpdated 26 days ago
Auto-check: warnings
Hunt Clueboard
zhaji2333/CkSKILLS
当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板，或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板（读→挖→写回），不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。
115 GitHub stars~606 tokensUpdated 26 days ago
Auto-check passed
Cloud Infra Supply Chain
zhaji2333/CkSKILLS
当目标涉及云资产（对象存储/云元数据/Serverless）、容器/K8s、运维面板（宝塔/Grafana/Zabbix/Jenkins/GitLab/Nacos等）、消息队列/缓存中间件、CI/CD流水线、第三方回调集成、依赖组件CVE、信息泄露配置时调用。负责未授权访问、弱口令、云配置错误、供应链漏洞与敏感信息挖掘。
115 GitHub stars~688 tokensUpdated 26 days ago
Auto-check: warnings

Works with

Questions about Injection Vulns

What does Injection Vulns do?

当发现参数拼接SQL、动态排序/筛选、JSON查询条件可控、模板渲染、命令执行点、搜索/统计/自动补全接口时调用，进行SQL/NoSQL/命令/SSTI/表达式注入的深度挖掘。命中场景：搜索框、排序参数、登录绕过、导出条件、文件名参数、模板/报表生成、爬虫URL参数。. Injection Vulns is an agent skill from zhaji2333/CkSKILLS.

When should I use Injection Vulns?

Injection Vulns fits situations like: tasks that involve NoSQL databases; tasks that involve SQL.

How do I install Injection Vulns in Claude Code?

Run `npx skills add zhaji2333/CkSKILLS --skill injection-vulns -a claude-code`. Or copy the skill folder (.agents/skills/injection-vulns in zhaji2333/CkSKILLS) into .claude/skills/injection-vulns in your project. Claude Code loads it when a task matches its description.

How do I install Injection Vulns in Codex?

Run `npx skills add zhaji2333/CkSKILLS --skill injection-vulns -a codex`. Or copy the skill folder (.agents/skills/injection-vulns in zhaji2333/CkSKILLS) into .agents/skills/injection-vulns in your project. Codex loads it when a task matches its description.

Can I use Injection Vulns in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add zhaji2333/CkSKILLS --skill injection-vulns -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/injection-vulns, .gemini/skills/injection-vulns, .github/skills/injection-vulns and .opencode/skills/injection-vulns in your project.

What does Injection Vulns need to run?

SKILL.md names no scripts, command-line tools or credentials: Injection Vulns is instructions for the agent only.

Does Injection Vulns access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Injection Vulns safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Injection Vulns use?

Injection Vulns is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Injection Vulns use?

About 579 tokens (SKILL.md is roughly 2.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Injection Vulns?

Skills that share tags, products or a category with Injection Vulns: Database Architecture Interviewer (PrepLabsAI/InterviewMentor, 112 stars), Injection (transilienceai/communitytools, 563 stars), Database (aiskillstore/marketplace, 433 stars) and AWS Storage (aws/agent-toolkit-for-aws, 2.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Injection Vulns?

zhaji2333 (a GitHub user) maintains it in zhaji2333/CkSKILLS, which has 115 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on September 15, 2026.

Source: zhaji2333/CkSKILLS on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Injection Vulns

Facts

At a glance

What it does

When your agent uses it

Example prompts

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

injection-vulns — 注入类漏洞专项深度挖掘

何时调用（触发条件）

一、漏洞类型全景

二、常见场景清单（搜索/查询类）

三、接口 Fuzz 技巧（参数污染与类型混淆）

四、SQL 注入绕过技术

五、命令注入绕过技术

六、验证要点

七、修复建议

八、输出与报告要点

Files

Compare with similar skills

Similar skills

More from zhaji2333/CkSKILLS

Related

Questions about Injection Vulns