security-payloads
From the author
Use when you need a specific exploit payload — XSS, SQLi, SSTI, SSRF, XXE, file upload bypass, auth bypass, command injection. Points to PayloadsAllTheThings + SecLists/Fuzzing locations, plus inline canonical payloads for the most common cases. Triggers on "xss payload", "sqli payload", "ssti payload", "ssrf bypass", "xxe payload", "command injection".
Install
npx skills add 26zl/cybersec-toolkit --skill security-payloads -a claude-code
Installs to .claude/skills/security-payloads/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 83
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- security-arsenal26zl/cybersec-toolkitSecurity payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.Security★ 82
- security-fuzzingEyadkelleh/awesome-skills-securityEssential fuzzing payloads: SQL injection, command injection, special characters. Curated essentials for vulnerability testing.Security★ 393
- offensive-xss26zl/cybersec-toolkitCross-Site Scripting testing checklist: stored/reflected/DOM/blind XSS discovery, polyglot payloads, CSP bypass, XSS filter bypass, event handler injection, DOM clobbering, mutation XSS, and impact escalation (session hijack, phishing, keylogging). Use for web app XSS testing and bug bounty. Use only for authorized security research, training, or assessment.Security★ 82
- security-wordlists26zl/cybersec-toolkitUse when you need wordlists for fuzzing, password cracking, content discovery, username enumeration, or pattern matching. Points to SecLists, PayloadsAllTheThings, and seclists-rolling that are already cloned by this installer. Triggers on "wordlist", "rockyou", "fuzz list", "common passwords", "directory wordlist", "subdomain wordlist".Security★ 82
- CTF•Web 漏洞asdfgh1445/ctf-super-hub用于 XSS、SQL 注入、SSTI、SSRF、XXE、JWT、鉴权绕过、文件上传、请求走私、OAuth/OIDC、SAML 与原型污染等 Web 类 CTF 题;触发名:ctf-webData★ 838
- testing-for-xss-vulnerabilities26zl/cybersec-toolkitTests web applications for Cross-Site Scripting (XSS) vulnerabilities by injecting JavaScript payloads into reflected, stored, and DOM-based contexts to demonstrate client-side code execution, session hijacking, and user impersonation. The tester identifies all injection points and output contexts, crafts context-appropriate payloads, and bypasses sanitization and CSP protections. Activates for requests involving XSS testing, cross-site scripting assessment, client-side injection testing, or JavaScript injection vulnerability testing.Security★ 82
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in