agentmods.dev

SecSkills: Instructions file for Claude Code

CLAUDE.md

SecSkills CLAUDE.md is an instructions file for Claude Code from Arenbai/SecSkills. It costs 1,616 tokens per session, scanned A, original, MIT.

A security testing guide for SecSkills, a library of practical penetration-testing techniques and reference material.

In plain words
What is it for?
Use it when producing penetration-test results, writing Python proof-of-concept files, citing security references, and deciding which findings to report.
Why use it?
It filters out unverified or low-value findings and requires reported vulnerabilities to have evidence, real impact, and a reproducible exploitation path.

Instructions file for Claude Code

Written for Claude Code: the file is CLAUDE.md. Also seen: mentions CLAUDE.md.

This is Arenbai/SecSkills's own configuration. It tells Claude Code how to work on SecSkills itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything SecSkills configures →

not rated 235repo +2 3mo ago A scan 1,616 tokens original MIT
View source ↗ Arenbai/SecSkills
Reuse

Borrowing it

Nothing to install: this file belongs to Arenbai/SecSkills. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/Arenbai/SecSkills/main/CLAUDE.md
Clone the repo
git clone --depth 1 https://github.com/Arenbai/SecSkills

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for SecSkills CLAUDE.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/arenbai/secskills/claude-md.svg)](https://agentmods.dev/instructions/arenbai/secskills/claude-md)
Your own site
<a href="https://agentmods.dev/instructions/arenbai/secskills/claude-md"><img src="https://agentmods.dev/badge/instructions/arenbai/secskills/claude-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 1,616 This file is loaded in full into every session.
When invoked 1,616 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.01616 $0.01616
Opus 5 $0.00808 $0.00808
Sonnet 5 $0.00323 $0.00323
Haiku 4.5 $0.00162 $0.00162

Measured 8d ago against content hash 23da082d0bd0, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

SecSkills CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 83 lines

How it starts

The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md — SecSkills 项目

定位

本项目是渗透测试实战技能库，核心定义在 SKILL.md，知识库在 references/ 目录（36个专项文件）。

项目级规则

  1. 知识库优先 — Payload/CVE/工具参数必须从 references/ 引用，格式 [引用:references/web-xxx.md §N]。未覆盖标注 ⚠️ UNABLE TO CITE，禁止凭记忆编造。
  2. 代码优先 Python — PoC/EXP 输出 Python 单文件，标准库优先，带注释和用法。
  3. 工具优先调用 — 用已有 MCP 工具和内置能力（Bash/Grep/WebSearch/WebFetch），不重复实现。
  4. 输出规范 — 漏洞标 🔴致命/🔴高危/🟡中危/🟢低危；每个漏洞标危害/前提/利用可行性 + 修复方案；命令完整可复制，IP用<target>占位；禁止开场客套话。
  5. 无意义漏洞过滤 — 输出前必过自检门（见下方），不输出黑名单项目。仅输出已确认利用的漏洞，无确认漏洞就说"未发现可利用漏洞"。
  6. CORS/CRLF/Cache-Poison/Host-Header/HTTP-Smuggling/GraphQL 默认不报 — 这些是技术特性/架构问题。除非展示完整利用链+实际数据泄露/账户劫持，否则一律不输出。

漏洞过滤体系（输出前强制执行）

核心原则：渗透报告的质量 = 过滤掉的噪音量。宁可漏报，不可误报。

第零关：快速预筛（任意命中 → 直接丢弃）

  • 扫描器自动报的、凭经验推测的、信息收集中间产物、安全加固建议、纯静态分析 → 直接丢弃

第一关：自检门（逐项 YES/NO，任一项 NO → 丢弃）

[ ] ① 实际发出了验证请求？       YES / NO
[ ] ② 拿到了真实响应数据？       YES / NO
[ ] ③ 造成了实际危害？           YES / NO  （"触发报错" ≠ "造成危害"）
[ ] ④ 利用链完整可复现？         YES / NO  （链中任一步为推测 → NO）
[ ] ⑤ 对照黑名单逐条检查通过？   YES / NO
[ ] ⑥ 满足等级最低准入标准？     YES / NO

③ 为 NO（无实际危害）→ 无条件丢弃，无论其他项是否为 YES。

第二关：黑名单（逐条对照，命中即丢弃）

  • 响应头: 缺少安全头/Cookie属性 → 合并为一条"安全配置建议"，不标等级
  • 信息泄露: 版本号/前端JS源码/目录列表/robots.txt（无敏感数据）/phpinfo（无凭据）/调试模式（无凭据）
  • 认证会话: 用户名枚举/密码策略/会话未销毁/autocomplete/JWT none alg（无绕过证明）/401/403
  • SSL/网络: 自签名/弱加密/TLS版本/OPTIONS/TRACE/管理后台存在但未进入
  • 未验证利用: SQL注入报错无数据/上传不解析/无回显XSS/SSRF无敏感数据/文件读只读到公开文件
  • 第三梯队（默认不报）: CORS Origin反射/Cache缓存头存在/Host头反射/CRLF回显/GraphQL内省/HTTP走私时间差异 — 除非完整利用链+实际数据泄露
  • 其他: 功能缺陷/短信轰炸/扫描器"疑似"/信息收集中间产物/同类型>3个/API无限频/条件极苛刻

第三关：严重等级准入（详见 SKILL.md）

  • 🔴 致命 = 拿权限（RCE/WebShell/命令注入）或核心DB拖库（≥3个敏感字段）
  • 🔴 高危 = 任意密码重置/重要系统注入/SSRF获凭证/任意文件读/越权敏感信息/本地提权
  • 🟡 中危 = 存储XSS（能窃取Cookie）/敏感CSRF/非核心SQL注入/普通越权/弱口令（有截图）
  • 🟢 低危 = 反射XSS（有弹窗）/非核心存储XSS/有限越权/特殊条件信息泄露
  • ⛔ 不收录 = 边缘环境/无法复现/无实际危害/同类型超3个/条件极苛刻

典型误判速查（这些不是漏洞）

看到的 别报为 原因
登录 "用户名不存在" vs "密码错误" 用户名枚举 常见UX设计，无实质危害
500错误含堆栈 信息泄露 除非含密码/Token/密钥
/admin 返回302 未授权访问 302=已正确保护
上传.php返回200 文件上传RCE 必须实际解析执行才算
内网IP返回HTTP响应 SSRF内网探测 必须获取到敏感数据才算

Read the full file on GitHub · 83 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 83 lines · 1,616 tokens per session scan A 23da082d0bd0

Subscribe to this mod's changes

SecSkills CLAUDE.md is an instructions file published in the GitHub repository Arenbai/SecSkills (235 stars, last pushed 3mo ago), licensed MIT. It adds 1,616 tokens to every session, about $0.0081 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Security
Related

Other instructions, from other repositories

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,296 tokens

codex AGENTS.md

AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.

openai/codex · 5,153 tokens

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 6,785 tokens

vscode oss-third-party-notices.instructions.md

Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).

microsoft/vscode · 5,001 tokens

langchain AGENTS.md

AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.

langchain-ai/langchain · 4,469 tokens

spec-kit AGENTS.md

AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.

github/spec-kit · 7,104 tokens