Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/MingyiSecLab/Mingyi-Atlasnpx agentmods add skills/mingyiseclab/mingyi-atlas/webWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mingyiseclab/mingyi-atlas/web)<a href="https://agentmods.dev/skills/mingyiseclab/mingyi-atlas/web"><img src="https://agentmods.dev/badge/skills/mingyiseclab/mingyi-atlas/web/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mingyiseclab/mingyi-atlas/web"><img src="https://agentmods.dev/badge/skills/mingyiseclab/mingyi-atlas/web.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.03681 |
| Opus 5 | $0.00030 | $0.01840 |
| Sonnet 5 | $0.00012 | $0.00736 |
| Haiku 4.5 | $0.00006 | $0.00368 |
Grade A, and why
web scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLlowData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -s 'https://<TARGET>/api' -H 'Content-Type: application/xml' -d '<?xml version="1.0"?><test>hello</test>' Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s 'https://<TARGET>/page?id=1%27' -o /dev/null -w '%{http_code}' This is a copy
94% identical to web — 26 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Web Application Exploitation — Category Overview
This is a routing skill. It helps you identify the correct attack technique, then directs you to the specialized sub-skill with full exploitation procedures.
Attack Technique Routing
Match the target's characteristics to the right sub-skill:
| Sub-Skill | Covers | When to Load | Path |
|---|---|---|---|
| sqli | Union/Error/Blind/Time-based SQL injection, sqlmap | SQL database, query parameters, login forms, search, filtering | load_skill("/skills/standard/exploit/web/sqli/SKILL.md") |
| blind-sqli | Manual WAF-bypass companion to sqli — token-fingerprinting probe loops, arithmetic-multiplication boolean evaluation, hex-encoded literals, exponential-probe binary search | Load AFTER sqli when sqlmap with --tamper cannot pass the WAF but a binary oracle (two distinct page states) exists; challenge tag is blind_sqli with active filtering |
load_skill("/skills/standard/exploit/web/blind-sqli/SKILL.md") |
| xss | Reflected/stored/DOM XSS, bot exfiltration, CSP bypass | Client-side JS injection, bot/report URL, cookie stealing | load_skill("/skills/standard/exploit/web/xss/SKILL.md") |
| ssti | Jinja2, Twig, Freemarker, ERB, Razor template injection | Template rendering, {{}} or ${} in output, Flask/Symfony/Java |
load_skill("/skills/standard/exploit/web/ssti-exploitation/SKILL.md") |
| ssrf | Cloud metadata, internal service access, Gopher smuggling | URL fetch parameter, redirect, internal network access | load_skill("/skills/standard/exploit/web/ssrf-exploitation/SKILL.md") |
| xxe | XML entity injection, SOAP/WSDL, blind OOB | XML processing, SOAP endpoints, XML file uploads | load_skill("/skills/standard/exploit/web/xxe-exploitation/SKILL.md") |
| lfi | Path traversal, PHP wrappers, log poisoning | File path parameters, ../, include/require, file download |
load_skill("/skills/standard/exploit/web/lfi/SKILL.md") |
| command-injection | OS command injection, blind/OOB, filter bypass | System commands, ping/traceroute, exec, subprocess | load_skill("/skills/standard/exploit/web/command-injection-exploitation/SKILL.md") |
| deserialization | Java/PHP/.NET/Python deserialization RCE | Serialized objects, base64 blobs, ViewState, pickle | load_skill("/skills/standard/exploit/web/deserialization-exploitation/SKILL.md") |
| idor | Authorization bypass, ID enumeration, privilege escalation | Object references, sequential IDs, UUIDs, access control | load_skill("/skills/standard/exploit/web/idor-exploitation/SKILL.md") |
| file-upload | Webshell upload, extension/content-type bypass | File upload forms, unrestricted upload | load_skill("/skills/standard/exploit/web/file-upload/SKILL.md") |
| graphql | Introspection, SQLi via resolvers, auth bypass | GraphQL API, /graphql endpoint, GQL queries | load_skill("/skills/standard/exploit/web/graphql/SKILL.md") |
| race-condition | TOCTOU, parallel POST/GET races, session-write-before-verdict, quota/balance/coupon double-spend | bcrypt/Argon2 auth, check-then-act, slow-op widening race window, challenge tag includes race_condition/toctou/concurrent | load_skill("/skills/standard/exploit/web/race-condition/SKILL.md") |
| smuggling | HTTP request smuggling (HRS) — CL.TE/TE.CL/TE.TE, CL.0, HTTP/2 downgrade (h2.cl, h2.te, CR/LF injection), pipelining, connection-state pinning | Multi-proxy/CDN frontend, differential 4xx/5xx on duplicate or obfuscated TE/CL headers, two Server: strings, h2 frontend with h1 backend, challenge tag includes smuggling_desync/request_smuggling/hrs/desync |
load_skill("/skills/standard/exploit/web/smuggling/SKILL.md") |
| crypto | Padding oracle (Vaudenay), AES-CBC bit-flipping, ECB block substitution, JWT alg confusion, hash-length extension | Base64 cookie/token w/ length %16 or %8, distinct invalid-pad vs auth-fail responses, JWT, repeated 16-byte ciphertext blocks, challenge tag includes crypto/cipher/oracle/captcha |
load_skill("/skills/standard/exploit/web/web-crypto-exploitation/SKILL.md") |
| business-logic | POST-body privilege fields, 2FA bypass, predictable TOTP codes, hidden auth headers, multi-step workflow tampering | Challenge tag includes business_logic, privilege_escalation, 2fa_bypass, auth_bypass (not pure IDOR/JWT) |
load_skill("/skills/standard/exploit/web/business-logic/SKILL.md") |
| cve | Known CVE exploitation — fingerprint → cve_lookup → cve_poc_lookup → adapt PoC → flag sweep; CMS/plugin/framework version-specific vulnerabilities |
Challenge tag includes cve, recon fingerprinted a versioned CMS/framework/plugin, challenge name hints at specific software (WordPress, Joomla, Struts, Spring4Shell, Log4j) |
load_skill("/skills/standard/exploit/web/cve/SKILL.md") |
| jwt | JSON Web Token attacks — alg=none, RS256↔HS256 confusion, kid header injection, JWKS spoofing, weak HMAC cracking, signature stripping | Authorization: Bearer eyJ..., id_token= / access_token=, .well-known/jwks.json, .well-known/openid-configuration |
load_skill("/skills/standard/exploit/web/jwt/SKILL.md") |
| oauth | OAuth 2.0 / OIDC abuse — redirect_uri smuggling, state CSRF, code/token leak via referer, PKCE downgrade, scope escalation | /oauth/authorize, /oauth/callback, response_type=code|token, client_id= parameters |
load_skill("/skills/standard/exploit/web/oauth/SKILL.md") |
| saml | SAML SSO abuse — XSW (signature wrapping), XML signature stripping, ACS URL substitution, IdP confusion, comment-in-NameID truncation | SAMLRequest= / SAMLResponse= POST bodies, /Shibboleth.sso/, /saml/acs, ADFS endpoints |
load_skill("/skills/standard/exploit/web/saml/SKILL.md") |
| ato-methodology | Account Takeover end-to-end — credential stuffing, password reset poisoning, email/phone change race, MFA fatigue, session fixation | /login, /reset-password, /account/email, /account/2fa endpoints, MFA enrollment flows |
load_skill("/skills/standard/exploit/web/ato-methodology/SKILL.md") |
| nosqli | NoSQL injection — MongoDB $ne/$gt/$where, Redis CRLF, Cassandra CQL, Couch view injection, DynamoDB filter abuse |
MongoDB/Redis/Cassandra/Couch/Dynamo backends, JSON request bodies with operator-like keys | load_skill("/skills/standard/exploit/web/nosqli/SKILL.md") |
| ldapi | LDAP injection — anonymous bind, wildcard filters, attribute exfil, blind boolean LDAP via attribute presence | LDAP-backed login, cn=/uid=-shaped queries, AD-joined web apps with form auth |
load_skill("/skills/standard/exploit/web/ldapi/SKILL.md") |
| xpath-xslt | XPath / XSLT injection — auth bypass, blind boolean extraction, XSLT RCE via document() / php:function, XEE |
XML-backed search/login, XSLT-transformed responses, ?xsl= parameters |
load_skill("/skills/standard/exploit/web/xpath-xslt/SKILL.md") |
| mass-assignment | Mass-assignment / over-posting — privilege fields (isAdmin, role, verified), nested object injection via JSON, GraphQL input-object abuse |
REST/GraphQL POST/PATCH with JSON bodies, ORM-backed APIs (Rails, Django, Express+Mongoose, Spring) | load_skill("/skills/standard/exploit/web/mass-assignment/SKILL.md") |
| open-redirect | Open redirect — auth callback, SSO relay state, OAuth redirect_uri, header-injection-based, JS-based location overrides |
?url=, ?next=, ?returnTo=, ?redirect=, ?continue= parameters; SSO RelayState |
load_skill("/skills/standard/exploit/web/open-redirect/SKILL.md") |
| cache-deception | Web cache deception — path confusion (/account.css, /account/index.css), Cloudflare/Varnish/CDN cache key abuse, header smuggling |
CDN-fronted apps (Cloudflare, Fastly, Akamai), Cache-Control permissive on static suffixes, per-user pages cacheable |
load_skill("/skills/standard/exploit/web/cache-deception/SKILL.md") |
| dom-clobbering | DOM clobbering — <form id=config> / <a name=cfg> to shadow JS globals, bypass JS validation, defeat client-side sanitizers |
Sites accepting user HTML, postMessage handlers using window.config.*, jQuery-extend patterns |
load_skill("/skills/standard/exploit/web/dom-clobbering/SKILL.md") |
| xs-leaks | Cross-Site Leaks — frame counting, COOP/COEP probing, performance-timing oracles, navigation-side-effects, error-event leaks | Authenticated cross-origin reads, OAuth response inference, SSO state leak, account-existence oracles | load_skill("/skills/standard/exploit/web/xs-leaks/SKILL.md") |
| proxy-misconfig | Reverse-proxy misconfig — origin bypass via Host/X-Forwarded-Host, ALB/ELB stripping, header-trust abuse, SSRF via internal proxy | Cloudflare / nginx / HAProxy / Envoy frontends, IP-allow-list endpoints (/admin), trusted-header auth |
load_skill("/skills/standard/exploit/web/proxy-misconfig/SKILL.md") |
What ships with it
30 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- ato-methodology/SKILL.md 4.2 KB
- blind-sqli/SKILL.md 10 KB
- business-logic/SKILL.md 7.3 KB
- cache-deception/SKILL.md 4.1 KB
- command-injection-exploitation/SKILL.md 5.3 KB
- cve/SKILL.md 11 KB
- deserialization-exploitation/SKILL.md 20 KB
- dom-clobbering/SKILL.md 4.1 KB
- file-upload/SKILL.md 4.2 KB
- graphql/SKILL.md 5.2 KB
- idor-exploitation/SKILL.md 16 KB
- jwt/SKILL.md 4.8 KB
- ldapi/SKILL.md 2.3 KB
- lfi/SKILL.md 20 KB
- mass-assignment/SKILL.md 4.6 KB
- nosqli/SKILL.md 3.4 KB
- oauth/SKILL.md 6.8 KB
- open-redirect/SKILL.md 4.0 KB
- proxy-misconfig/SKILL.md 4.7 KB
- race-condition/SKILL.md 7.0 KB
- saml/SKILL.md 5.3 KB
- smuggling/SKILL.md 37 KB
- sqli/SKILL.md 11 KB
- ssrf-exploitation/SKILL.md 7.1 KB
- ssti-exploitation/SKILL.md 18 KB
- web-crypto-exploitation/SKILL.md 19 KB
- xpath-xslt/SKILL.md 2.7 KB
- xs-leaks/SKILL.md 4.1 KB
- xss/SKILL.md 16 KB
- xxe-exploitation/SKILL.md 5.5 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 132 lines · 60 tokens per session scan A e1ada4905610
web is a skill published in the GitHub repository MingyiSecLab/Mingyi-Atlas (11 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 60 tokens to every session and 3,681 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 2 findings (sends data to an external url, makes network calls). It is 94% identical to web, differing in 26 lines, and is treated as a copy.
Other skills, from other repositories
cis-aws-foundations-4.3
Ensure AWS Config is enabled in all regions.
cis-aws-foundations-6.5
Ensure the default security group of every VPC restricts all traffic.
cis-aws-foundations-2.1.3
Ensure Organizations management account is not used for workloads.
cis-aws-foundations-4.4
Ensure that server access logging is enabled on the CloudTrail S3 bucket.
cis-aws-foundations-6.1.2
Ensure CIFS access is restricted to trusted networks to prevent unauthorized access.
cis-aws-foundations-2.5
Ensure MFA is enabled for the 'root' user account.