Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add SecurityTalent/bugskill-ai --skill type-jugglinggit clone --depth 1 https://github.com/SecurityTalent/bugskill-aiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/securitytalent/bugskill-ai/type-juggling)<a href="https://agentmods.dev/skills/securitytalent/bugskill-ai/type-juggling"><img src="https://agentmods.dev/badge/skills/securitytalent/bugskill-ai/type-juggling/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/securitytalent/bugskill-ai/type-juggling"><img src="https://agentmods.dev/badge/skills/securitytalent/bugskill-ai/type-juggling.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.03204 |
| Opus 5.5 | $0.00022 | $0.01282 |
| Sonnet 5.5 | $0.00011 | $0.00641 |
| Haiku 4.5 | $0.00005 | $0.00320 |
Grade A, and why
type-juggling scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to type-juggling — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 292 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SKILL: PHP Type Juggling — Weak Comparison & Magic Hash Bypass
AI LOAD INSTRUCTION: PHP
==coercion, magic hashes (0e…), HMAC/hash loose checks, NULL from bad types, and CTF-stylestrcmp/json_decode/intvaltricks. Use strict routing: map the sink (==vshash_equals), PHP major version, and whether both operands are attacker-controlled. Routing note: when you encounter PHP login/signature logic or code likemd5($_GET['x'])==md5($_GET['y']), start with this skill; ifhash_equals/===is already used, this path usually does not apply.
0. QUICK START
First-pass goal: prove the server branch treats unequal secrets/tokens as equal via coercion, not guess the real password.
First-pass payloads (auth / token shape)
password[]=x
password=
0
0e12345
240610708
QNKCDZO
true
[]
{"password":true}
admin%00
Minimal PHP probes (local or php -r in lab)
<?php
// Loose compare probes — run in target PHP major version if possible
var_dump('0e123' == '0e999');
var_dump('123a' == 123);
var_dump(md5('240610708') == md5('QNKCDZO'));
Routing hints
| Clue | Next step |
|---|---|
Source code uses == to compare passwords, tokens, or HMAC values |
Go to Sections 1-3 |
md5($a) == md5($b) or loose sha1 comparison |
Section 2 magic hashes |
hash_hmac(...) != '0' or compared with "0" |
Section 3 |
strcmp、json_decode(..., true)、intval |
Section 5 |
1. LOOSE COMPARISON (==) — TRUTH TABLE & VERSIONS
PHP compares operands with type juggling unless you use === or hash_equals() for secrets.
1.1 Core examples (strings vs numbers)
| Expression | Result | Mechanism (short) |
|---|---|---|
'0010e2' == '1e3' |
true | Both strings look numeric → compared as floats; both parse to 1000.0 (not zero — common exam trap; see next row for real “both zero”) |
'0e462097431906509019562988736854' == '0e830400451993494058024219903391' |
true | Both parse as 0.0 in scientific notation |
'123a' == 123 |
true | String cast to int stops at first non-digit → 123 |
'abc' == 0 |
true (PHP 7.x and earlier) | Non-numeric string compared to int → string becomes 0 |
'' == 0 |
true | Empty string → 0 |
'' == false |
true | both “falsy” in loose rules |
false == NULL |
true | loose equality |
0 == false |
true | loose equality |
'' == 0 == false == NULL |
true (chain) | Each adjacent pair is true under == (''==0, 0==false, false==NULL) — classic “falsy” chain |
'0' == false |
true | String '0' is the only non-empty string that compares as false to boolean |
'php' == 0 |
false (PHP 8+) | PHP 8: non-numeric string no longer equals 0 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 292 lines · 54 tokens per session scan A b8da531733cb
type-juggling is a skill published in the GitHub repository SecurityTalent/bugskill-ai (13 stars, last pushed 21d ago), licensed MIT. It adds 54 tokens to every session and 3,204 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to type-juggling, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
architecture-patterns
Use this skill when choosing a system-level architecture (monolith, modular monolith, microservices, event-driven, serverless, clean/hexagonal, or DDD) for a new or growing PHP application, or when weighing a premature move to a more distributed style. Provides a decision guide and the common pitfalls that cause…
event-sourcing
Use this skill when evaluating or implementing Event Sourcing in a PHP application. Triggers on questions about event stores, aggregates, projections, snapshots, event replay, temporal queries, CQRS with event sourcing, or PHP event-sourcing libraries (Ecotone, Prooph, EventSauce, Patchlevel). Distinguishes Event…
application-layer
Use this skill when writing controllers, structuring use cases, or implementing Service Layer / Application Layer and Command/Query/Handler (CQRS) patterns in PHP applications. Triggers on questions about thin controllers, handler responsibilities, service definition, or DTO usage.
dependency-injection
Use this skill when wiring dependencies, configuring a DI container, designing plugin/extension points, or migrating away from legacy service locators in PHP. Triggers on questions about constructor injection, interface registration, swapping implementations, or testing without booting the container.
framework-integration
Use this skill when applying clean-architecture, DDD, or hexagonal patterns inside a specific PHP framework. Provides framework-specific port mapping, adapter patterns, and pitfalls to avoid for Laravel, Symfony, Slim, CakePHP, CodeIgniter, Yii, Laminas, Mezzio, Zend Framework, and legacy/maintenance-mode frameworks.…
laravel-security
Laravel security best practices for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.