skills.rest
yunmengya
yunmengyaCOMMUNITY
Explore all skills by this author →
GitHub

php-rce-audit

Audit PHP projects for command and code execution vulnerabilities.

80|6|Updated Feb 27, 2026
Search Tags:#php#security audit#code execution#command execution#vulnerability analysis#rce
One-click install
npx skills add https://github.com/yunmengya/PHP_AUDIT_SKILLS --skill php-rce-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: php-rce-audit
Source: https://github.com/yunmengya/PHP_AUDIT_SKILLS/tree/main/php-rce-audit
Command: npx skills add https://github.com/yunmengya/PHP_AUDIT_SKILLS --skill php-rce-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need to identify and audit command execution and code execution vulnerabilities within PHP projects, providing evidence-based findings for remediation.

Core Features & Use Cases

  • Vulnerability Identification: Locates dangerous functions and call points related to command and code execution.
  • Evidence Tracing: Tracks the chain of controllable input to dangerous sinks, identifying protective measures.
  • Output Generation: Produces structured findings in JSON and Markdown formats, including recommendations for secure alternatives.
  • Use Case: A security auditor can use this Skill to quickly scan a PHP codebase for potential RCE vulnerabilities, understand the exploit path, and receive clear reports and suggested fixes.

Quick Start

Use the php-rce-audit skill to audit the project located at /path/to/your/php/project.

Frequently Asked Questions about php-rce-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit PHP code for remote code execution vulnerabilities?▼

You can audit PHP code for remote code execution vulnerabilities by scanning the project to identify dangerous functions and trace controllable input paths to dangerous sink points. The audit outputs structured findings in JSON and Markdown formats.

What is the best way to trace user input to dangerous PHP functions?▼

Tracing user input to dangerous PHP functions involves tracking the data flow from controllable inputs to command or code execution sinks. This process identifies existing protective measures like filters and whitelists to generate evidence-based findings.

How do I scan a PHP project for command execution risks?▼

You scan a PHP project for command execution risks by analyzing the codebase for dangerous call points and evaluating protective measures. The scan generates evidence-based reports with remediation recommendations for secure alternatives.

Do I need a Docker environment to debug PHP vulnerability findings?▼

A Docker environment is supported for detailed debugging of PHP vulnerability findings. This allows you to validate the traced input chains and analyze the exploit path within an isolated container.

Can I get remediation recommendations for PHP RCE vulnerabilities?▼

You can get remediation recommendations for PHP RCE vulnerabilities directly from the generated findings. The output provides clear reports in JSON and Markdown formats, including suggested fixes and secure alternatives.

Related Skills

Explore More Software Engineering Skills→
saskinosiesaskinosie
39

weaviate-local-setup

Sets up and manages a local Weaviate Docker instance with vectorizers and data persistence via Docker volumes.

Community
Advanced
nksethnkseth

security-reviewer

Identify security vulnerabilities in code and infrastructure and deliver prioritized audit reports with remediation guidance.

Community
Advanced
fusenginefusengine
22

security-scan

Scan JavaScript, PHP, Python, Swift, Go, and Rust code for vulnerabilities.

Community
Advanced
mvillmowmvillmow
18

scan-vulnerabilities

Detect security vulnerabilities in code and dependencies with static analysis.

Community
Intermediate