How do I install the Web Security skill?

Run npx skillmds@latest add majiayu000/web-security-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Web Security skill do?

Exploits web application vulnerabilities. Use when working with SQL injection, XSS, SSRF, SSTI, command injection, path traversal, authentication bypass, deserialization, or any web-based CTF challenge. It is listed under Data & Analytics, Security on SkillMD.

Is Web Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only, makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web Security?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Security by majiayu000 — Agent Skill

Name: Web Security
Rating: 4.2 (5 reviews)
Author: majiayu000

File contents

Web Security Skill

Quick Workflow

Progress:
- [ ] Identify technology stack
- [ ] Check common files (robots.txt, .git)
- [ ] Test injection points (SQLi, XSS, SSTI)
- [ ] Check authentication/session flaws
- [ ] Develop exploit
- [ ] Extract flag

Quick Recon

# Directory enumeration
gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt
ffuf -u http://target/FUZZ -w wordlist.txt

# Technology detection
whatweb http://target
curl -I http://target

# Check robots.txt, .git exposure
curl http://target/robots.txt
curl http://target/.git/HEAD

Vulnerability Reference

Vulnerability	Reference File
SQL Injection	reference/sqli.md
XSS	reference/xss.md
SSTI	reference/ssti.md
Command Injection	reference/command-injection.md
SSRF / Path Traversal	reference/ssrf-lfi.md
Auth Bypass / Deserialization	reference/auth-deser.md

Tools Quick Reference

Tool	Purpose	Command
sqlmap	SQLi automation	`sqlmap -u URL --dbs`
commix	Command injection	`commix -u URL`
tplmap	SSTI automation	`tplmap -u URL`
ffuf	Fuzzing	`ffuf -u URL/FUZZ -w wordlist`
Burp Suite	Proxy/intercept	GUI
jwt_tool	JWT attacks	`jwt_tool TOKEN`

Frequently asked questions

Web Security