wrangler-oast

97 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By dreadnode/capabilities (GitHub) · security · 22 stars · scanned at commit 3ceeb34

Deploy Cloudflare Workers as custom OAST endpoints for blind XSS payload hosting, configurable callback receivers, and SSRF redirect servers. Use when you need attacker-controlled infrastructure beyond what interactsh/webhook.site provides — custom response bodies, JS payload serving, or 302 redirect chains. Requires CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID (CF_API_TOKEN / CF_ACCOUNT_ID aliases accepted). Triggers on 'blind XSS', 'custom callback server', 'OAST worker', 'serve a payload',…

Works with any agent that supports SKILL.md skills.

What this skill can do

Connects to the internet

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 1 place.

capabilities/web-security/skills/wrangler-oast/SKILL.md, line 60wrangler_deploy(template="custom", worker_code='export default { fetch() { return new Response("<html>custom</html>", { headers: { "Content-Type": "text/html" }

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'wrangler-oast' ] || [ -L ~/.agents/skills/'wrangler-oast' ]; then echo 'A skill folder named wrangler-oast already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/dreadnode/capabilities' "$d" && git -C "$d" checkout --quiet '3ceeb34c0c33dc36738cf0d4ec86e38b53d98216' -- 'capabilities/web-security/skills/wrangler-oast' && mkdir -p ~/.agents/skills && cp -R "$d"/'capabilities/web-security/skills/wrangler-oast' ~/.agents/skills/'wrangler-oast' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'wrangler-oast' ~/.claude/skills/'wrangler-oast' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for dreadnode/capabilities shows the score of its lowest-scoring skill.

SkillTrust badge for dreadnode/capabilities

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/dreadnode/capabilities.svg)](https://zalavijaysinh.github.io/skilltrust/repos/dreadnode/capabilities/)

Score history

Date	Version	Score
2026-11-11	`3ceeb34`	97