What problem does it solve?
After individual PHP vulnerability audits produce isolated findings, it is hard to judge real-world impact without evaluating how those vulnerabilities combine. This Skill assembles confirmed findings into complete attack chains and verifies whether each link's preconditions actually hold.
Core Features & Use Cases
- Exploit Chain Assembly: Builds a vulnerability relationship graph mapping each finding's output capability (file write, request, data leak, code execution) to another finding's input, covering file-write-to-include RCE, SQLi-to-webshell, deserialization POP chains, SSRF-to-internal-service, info-leak-to-auth-bypass, and XSS-plus-CSRF chains.
- Precondition Verification: Checks authentication requirements, network reachability, timing dependencies, and environment constraints such as open_basedir, disable_functions, and secure_file_priv for every chain step.
- Composer Dependency CVE Scanning: Parses composer.lock, compares versions against Packagist Security Advisories and CVE databases, and folds dependency CVEs into the chain graph.
- Use Case: After completing PHP injection, file, and deserialization audits on an application, use this Skill to determine whether a low-severity file write plus a controllable include path yields a Critical RCE chain, and document break points for chains that fail.
Quick Start
Evaluate the confirmed vulnerabilities from my PHP audit and assemble feasible exploit chains with severity scores and break-point analysis.
