# Commix

> Use for controlled command-injection validation during authorized web and API assessments. Trigger on manually triaged injection candidates, request replay validation, and narrow retests where the least invasive proof path is required.

- Skill: `timsonner/commix` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/commix`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/commix/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/commix

---


# Commix

## Purpose

Use this skill only after manual triage suggests a credible command-injection candidate and the rules of engagement allow controlled validation.

## Phase Fit

- Primary: Validation and Controlled Impact Demonstration
- Secondary: Vulnerability Analysis, Retest and Closure

## Use When

- Need to validate a likely command-injection issue with the lowest safe settings.
- Need a repeatable retest for an already triaged command-injection candidate.
- Need focused automation around a known proof path.

## Avoid When

- No credible injection candidate exists.
- Automated probing would exceed the approved impact level.

## Inputs

- Approved URL or request path
- Suspected parameter and auth context
- Stop conditions and impact ceiling

## Procedure

1. Start with the lowest-risk validation path.
2. Validate only the specific parameter or request already under review.
3. Stop as soon as the issue is confirmed to the approved standard.
4. Record the exact request path and options used.
5. Preserve the proof path for retest.

## Command Syntax

Replace sample targets with approved in-scope URLs.

```bash
# Basic GET parameter injection test
commix --url 'https://portal.contoso.com/ping.php?target=127.0.0.1'

# POST body injection
commix --url 'https://portal.contoso.com/api/exec' --data 'cmd=ls'

# HTTP header injection (X-Forwarded-For)
commix --url 'https://portal.contoso.com/log' --headers 'X-Forwarded-For:*'

# Authenticated scan with session cookie
commix --url 'https://portal.contoso.com/admin/tools' --cookie 'session=<token>'

# Use only time-based blind technique
commix --url 'https://portal.contoso.com/ping.php?ip=127.0.0.1' --technique=time

# Replay a saved HTTP request file
commix --request-file request.txt
```

## Evidence to Capture

- Exact parameter or request path that validated
- Preconditions required for reproduction
- Minimal proof needed for remediation

## Safety Boundaries

- Do not escalate beyond minimal proof without explicit written approval.
- Stop immediately if the application shows instability or unintended state changes.