object-injection-deserialization
From the author
Use when code calls unserialize, maybe_unserialize, or stores serialized PHP in options, meta, or transients from untrusted input. Avoids unserialize on attacker-controlled data, prefers json_encode / json_decode, and when unserialize is unavoidable passes ['allowed_classes' => false]. Prevents PHP object injection and POP-chain remote code execution.
Install
npx skills add wpultimatesecurity/WordPress-Security-Skills --skill object-injection-deserialization -a claude-code
Installs to .claude/skills/object-injection-deserialization/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 76
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- exploiting-insecure-deserialization26zl/cybersec-toolkitIdentifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.Security★ 82
- offensive-deserialization26zl/cybersec-toolkitInsecure deserialization attack checklist: identifying deserialization sinks, Java/PHP/.NET/Python deserialization exploitation, ysoserial gadget chains, magic method abuse, and detection evasion. Use when testing deserialization endpoints or developing deserialization exploits. Use only for authorized security research, training, or assessment.Security★ 82
- jackson-securitycxcscmu/SkillLearnBenchSecurity considerations for Jackson JSON deserialization, specifically regarding `@JacksonInject` and unintended property overrides.Security★ 91
- jackson-inject-securitycxcscmu/SkillLearnBenchSecurity considerations for Jackson @JacksonInject annotation in Java applications. How to prevent JSON input from overriding server-injected values. Use this skill whenever reviewing code that uses @JacksonInject, when an attacker could supply JSON to override configuration objects, or when fixing deserialization vulnerabilities related to injectable values.Security★ 91
- hunt-deserializationEncod3d-Sec/TORCHInsecure deserialization hunting across Java / .NET / PHP / Python / Ruby / Node. Gadget-chain RCE, OOB-gated blind detection, magic-byte fingerprinting. Wiki-first, FIND schema output.Engineering★ 335
- owasp-webnahid-sparktales/agent-dispatcherHunt the web failure classes that actually recur — broken access control, injection, XSS by output context, SSRF, unsafe deserialization and mass assignment, session and token handling, secrets leakage, file handling — as patterns to find in this codebase. Use when writing or reviewing request handlers, queries, URL fetches, templates, uploads or auth code, or when asked to check a web app for the common vulnerability classes. Not for design-stage modeling (threat-modeling), not infrastructure or network hardening, and not a list to recite without reading code.Security★ 59
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in