Borrowing it
Nothing to install: this file belongs to zhaji2333/CkSKILLS. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zhaji2333/CkSKILLS/main/.agents/skills/injection-vulns/SKILL.mdgit clone --depth 1 https://github.com/zhaji2333/CkSKILLSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhaji2333/ckskills/injection-vulns)<a href="https://agentmods.dev/skills/zhaji2333/ckskills/injection-vulns"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/injection-vulns/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhaji2333/ckskills/injection-vulns"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/injection-vulns.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 74 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 75 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00105 | $0.01345 |
| Opus 5 | $0.00053 | $0.00673 |
| Sonnet 5 | $0.00021 | $0.00269 |
| Haiku 4.5 | $0.00011 | $0.00135 |
Grade A, and why
injection-vulns scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- 用户输入进入 shell 命令（exec/system/ProcessBuilder、ping/curl/文件名拼接） How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
injection-vulns — 注入类漏洞专项深度挖掘
何时调用（触发条件）
- 参数直接拼接到 SQL / NoSQL 查询（搜索、筛选、排序、分页、导出条件）
- JSON 查询条件可控（
{"$gt":0}等 MongoDB 风格） - 用户输入进入 shell 命令（exec/system/ProcessBuilder、ping/curl/文件名拼接）
- 用户输入进入模板引擎（Jinja2/Velocity/Freemarker/Thymeleaf）
- 用户输入进入表达式解释器（SpEL/OGNL/EL/MVEL）
- 危险函数出现在代码审计结果中（见
source-code-audit）
一、漏洞类型全景
| 类型 | 危险函数/场景 | 挖掘要点 |
|---|---|---|
| C1. SQL注入 | 拼接SQL、动态排序 | 响应差异验证（错误/延迟/条数） |
| C2. NoSQL注入 | JSON查询条件可控 | 类型替换、全量查询 |
| C3. 命令注入 | exec/system/ProcessBuilder | shell拼接、管道符 |
| C4. 模板注入（SSTI） | Jinja2/Velocity/Freemarker | 用户输入进入模板渲染 |
| C5. 表达式注入 | SpEL/OGNL/EL | 可控片段进入解释器 |
二、常见场景清单（搜索/查询类）
| 场景 | 漏洞类型 | 挖掘要点 |
|---|---|---|
| 站内搜索 | SQL注入/XSS/信息泄露 | 搜索词拼接、搜索结果反射 |
| 高级筛选/排序 | SQL注入/NoSQL注入 | order by注入、筛选条件可控 |
| 自动补全/联想 | 信息泄露/用户枚举 | 补全接口泄露敏感数据 |
| 数据统计/图表 | SQL注入/越权 | 统计维度可控、跨权限聚合 |
| ES/Solr搜索 | 查询注入/未授权 | DSL注入、搜索接口暴露 |
三、接口 Fuzz 技巧（参数污染与类型混淆）
参数污染：
?id=1&id=2 → 看哪个生效
?id[]=1&id[]=2 → 数组化
?id=1,2,3 → 批量查询
类型混淆：
id=1 → id="1" → id={"$gt":0} → id[]=1
编码绕过：
Unicode: \u002e\u002e/ (../)
双重URL编码: %252e%252e%252f
隐藏参数：
debug=1 / test=1 / admin=1
_method=PUT / X-HTTP-Method-Override
批量操作：
ids=1,2,3,4,5 一次查多个
page=-1 / limit=99999 绕过分页
四、SQL 注入绕过技术
大小写：SeLeCt / 双写：selselectect
注释：/**/、/*!*/、--+、#
编码：URL编码、十六进制、Unicode
等价函数：substr→mid、ascii→ord
五、命令注入绕过技术
分隔符：| / || / & / && / ; / %0a
空格：${IFS} / $IFS$9 / %09 / {cat,/etc/passwd}
通配符：/???/??t /etc/passwd
六、验证要点
- 响应差异对比：基线请求 vs 注入请求的状态码/响应大小/错误信息/响应时间
- 时间盲注：
SLEEP(5)/pg_sleep(5)/WAITFOR DELAY '0:0:5'验证 - 报错注入：
updatexml/extractvalue/ 类型转换错误 - NoSQL：
{"$ne":null}、{"$where":"1==1"}、数组/类型替换 - SSTI：
{{7*7}}、${7*7}、<%= 7*7 %>探测 - 命令注入：
id、whoami、DNSLog 外带 - 所有注入点至少尝试到 Level 4 绕过（见 CLAUDE.md 1.1 第五节）
七、修复建议
- SQL：预编译/参数化查询，动态排序用白名单映射
- NoSQL：禁止
$运算符进入查询条件，类型强校验 - 命令：白名单命令 + 参数数组传递，禁止 shell 拼接
- SSTI：模板引擎关闭危险特性（Jinja2 禁用
__class__链） - 表达式：禁止用户可控片段进入 SpEL/OGNL/EL 解释器
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 103 lines · 105 tokens per session scan A ab71d261f87e
injection-vulns is a skill published in the GitHub repository zhaji2333/CkSKILLS (80 stars, last pushed 10d ago), licensed MIT. It adds 105 tokens to every session and 1,345 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
officecli-word-form
Use this skill to create fillable Word forms (.docx) with real Content Controls (SDT) + legacy FormField checkboxes + MERGEFIELD mail-merge placeholders + document protection. Trigger on: 'fillable form', 'form fields', 'content controls', 'SDT', 'word form', 'fill in', 'only editable fields', 'protect document'…
dingtalk_channel_connect
Use a headed browser to automatically complete DingTalk channel integration for QwenPaw. Applicable when the user mentions DingTalk, developer console, Client ID, Client Secret, bot, Stream mode, binding or configuring a channel. Supports pausing when a login page is detected and resuming after the user logs in.
A set of instructions for working with PDF files, which are documents designed to preserve their layout across devices.
officecli-data-dashboard
Use this skill to build a multi-element Excel dashboard — Dashboard sheet on open, multiple formula-driven KPI cards, multiple charts, sparklines, and conditional formatting — from CSV or tabular input. Trigger on: 'dashboard', 'KPI dashboard', 'analytics dashboard', 'executive dashboard', 'metrics dashboard', 'CSV to…
make_plan
For external plan request scenarios, guides the Agent to request a clear, actionable, step-by-step plan from a stronger Agent via listagents and chatwithagent, emphasizing that the plan is executed by the requester, not by the consulted Agent.
gpt-image-2
A skill for generating or editing images with GPT Image 2 across local, host-provided, or advisory setups.