skills.rest
chatbotkit
chatbotkitOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-arsenal

Catalog offensive security payloads for XSS, SSRF, SQLi, and related vulnerabilities.

13|2|Updated Jun 1, 2026
Search Tags:#xss#sqli#payloads#ssrf#security-testing#idor#xxe
One-click install
npx skills add https://github.com/chatbotkit/rook --skill security-arsenal-chatbotkit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-arsenal
Source: https://github.com/chatbotkit/rook/tree/main/skills/security-arsenal
Command: npx skills add https://github.com/chatbotkit/rook --skill security-arsenal-chatbotkit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Payload libraries and bypass references streamline offensive security testing by providing ready-to-use payloads and rules for common weaknesses.

Core Features & Use Cases

  • Payload library covering XSS, SSRF, SQLi, XXE, NoSQLi, command injection, SSTI, IDOR, path traversal, HTTP smuggling, WebSocket, MFA bypass.
  • Includes bypass tables, always-rejected bug list, and conditionally-valid-with-chain guidance.
  • GF pattern names support quick extraction and pattern matching for parameter discovery.
  • Wordlists and submission-rule references help validate findings and ensure safe reporting.
  • Use Case: security engineers rapidly assemble end-to-end test chains to reproduce and document vulnerabilities.

Quick Start

Browse the payload sections to select a relevant payload and adapt it to a target for testing.

Frequently Asked Questions about security-arsenal

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Where can I find a comprehensive payload library for XSS, SSRF, and SQLi testing?▼

A comprehensive payload library for XSS, SSRF, and SQLi testing provides ready-to-use injection strings, bypass tables, and wordlists. It allows security engineers to quickly select relevant payloads and adapt them to specific targets during offensive testing.

How do I build an end-to-end verification workflow for command injection vulnerabilities?▼

Building an end-to-end verification workflow for command injection involves using a conditional-chain guidance system alongside payload libraries. This structured repository helps security engineers assemble test chains to reproduce and document vulnerabilities accurately.

Does this payload repository include bypass patterns for XXE and NoSQLi vulnerabilities?▼

Yes, the payload repository includes bypass patterns for XXE and NoSQLi vulnerabilities. It also covers SSTI, IDOR, path traversal, HTTP smuggling, WebSocket, and MFA bypass, providing extensive tables and conditionally-valid-with-chain guidance.

Can I use gf pattern names for parameter discovery during security testing?▼

You can use gf pattern names for parameter discovery during security testing. The repository includes specific gf pattern names to support quick extraction and pattern matching, streamlining the identification of potential vulnerability parameters.

What submission rules are included for validating security findings?▼

Submission-rule references are included to help validate findings and ensure safe reporting during offensive security testing. These rules work alongside wordlists and an always-rejected bug list to maintain testing integrity and proper documentation.

Related Skills

Explore More Software Engineering Skills→
alexfazioalexfazio
159

cc-trace

Intercept and inspect Claude Code API traffic using mitmproxy.

Community
Advanced
rahmatullahbossrahmatullahboss

Cross-Site Scripting and HTML Injection Testing

Identify XSS vulnerabilities and craft payloads for stored, reflected, and DOM-based vectors.

Community
Advanced
MicrockMicrock
322

ffuf-web-fuzzing

Automate web content discovery by fuzzing targets with ffuf to reveal hidden resources.

Community
Advanced
utsavthakurutsavthakur

expression-language-injection

Detect and exploit Expression Language injection vulnerabilities in Java frameworks.

Community
Advanced