security-arsenal

Name: security-arsenal
Availability: InStock
Author: ChatBotKit

Catalog offensive security payloads for XSS, SSRF, SQLi, and related vulnerabilities.

13|2|Updated Jun 1, 2026

Search Tags:#xss #sqli #payloads #ssrf #security-testing #idor #xxe

Ready to run

npx skills add https://github.com/chatbotkit/rook --skill security-arsenal-chatbotkit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-arsenal
Source: https://github.com/chatbotkit/rook/tree/main/skills/security-arsenal
Command: npx skills add https://github.com/chatbotkit/rook --skill security-arsenal-chatbotkit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Payload libraries and bypass references streamline offensive security testing by providing ready-to-use payloads and rules for common weaknesses.

Core Features & Use Cases

Payload library covering XSS, SSRF, SQLi, XXE, NoSQLi, command injection, SSTI, IDOR, path traversal, HTTP smuggling, WebSocket, MFA bypass.
Includes bypass tables, always-rejected bug list, and conditionally-valid-with-chain guidance.
GF pattern names support quick extraction and pattern matching for parameter discovery.
Wordlists and submission-rule references help validate findings and ensure safe reporting.
Use Case: security engineers rapidly assemble end-to-end test chains to reproduce and document vulnerabilities.

Quick Start

Browse the payload sections to select a relevant payload and adapt it to a target for testing.

Frequently Asked Questions about security-arsenal

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

Where can I find a comprehensive payload library for XSS, SSRF, and SQLi testing?▼

A comprehensive payload library for XSS, SSRF, and SQLi testing provides ready-to-use injection strings, bypass tables, and wordlists. It allows security engineers to quickly select relevant payloads and adapt them to specific targets during offensive testing.

How do I build an end-to-end verification workflow for command injection vulnerabilities?▼

Building an end-to-end verification workflow for command injection involves using a conditional-chain guidance system alongside payload libraries. This structured repository helps security engineers assemble test chains to reproduce and document vulnerabilities accurately.

Does this payload repository include bypass patterns for XXE and NoSQLi vulnerabilities?▼

Yes, the payload repository includes bypass patterns for XXE and NoSQLi vulnerabilities. It also covers SSTI, IDOR, path traversal, HTTP smuggling, WebSocket, and MFA bypass, providing extensive tables and conditionally-valid-with-chain guidance.

Can I use gf pattern names for parameter discovery during security testing?▼

You can use gf pattern names for parameter discovery during security testing. The repository includes specific gf pattern names to support quick extraction and pattern matching, streamlining the identification of potential vulnerability parameters.

What submission rules are included for validating security findings?▼

Submission-rule references are included to help validate findings and ensure safe reporting during offensive security testing. These rules work alongside wordlists and an always-rejected bug list to maintain testing integrity and proper documentation.