WooYun Legacy plugin
A Claude Code plugin for business-logic vulnerabilities: testing methodology and references to real WooYun cases for authorized audit reports
- 1,787 ★ on the repository
- Last commit
Broad access
Why this level
- Provides offensive business-logic testing methodology for payment and authorization systems
- Ships real cases and attack patterns and is meant only for authorized testing
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/wooyun-legacyDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Provides offensive business-logic testing methodology for payment and authorization systems
- Ships real cases and attack patterns and is meant only for authorized testing
This is third-party code. Review the repository files before installing.
What it does
The plugin adds a knowledge base of business-logic vulnerabilities to Claude Code, distilled from WooYun public cases from 2010 to 2016. By the author's account it does not teach new attack techniques but backs the model's answers with references to real cases, frequency and severity statistics, and test prioritization. The material is split by area: amount tampering and payment flows, privilege escalation and bypass, IDOR and unauthorized access, password reset and weak credentials, logic flaws and race conditions, and code audit. It activates on explicit security requests and on implicit black-box scenarios. The author stresses the set is meant only for authorized testing, audit and education.
Who it is for. For security professionals and engineers running authorized testing, code audit and risk review.
Good fit when
- You need methodology and priorities for an authorized business-logic test: payments, access control, password reset
- You need to back a report with real case references and statistics
- You need a code audit of an API for logic vulnerabilities together with the agent
Not a fit when
- You have no written authorization to test the target
- You need coverage of modern stacks: the data spans up to 2016
Example request
Draft an authorized test plan for this shop's payment logic and back it with real casesLimitations
Licensed CC-BY-NC-SA-4.0, non-commercial use with attribution. The data spans 2010 to 2016, so modern stacks such as cloud services, GraphQL and Serverless are thinly covered. The set is intended only for authorized testing, and the legality of use is the user's responsibility. Source cases are mostly in Chinese, with an English README. The full case database is tens of megabytes and installs only in the full setup.
How to disable. Uninstall the plugin: claude plugin uninstall wooyun-legacy, then optionally remove the marketplace: claude plugin marketplace remove tanweai-security.
FAQ
Does the plugin teach new attacks?
By the author's account, no. It adds real case references, statistics and priorities to methodology the model already knows, and is meant for authorized testing.
How current is the data?
The cases span 2010 to 2016. The author notes business-logic flaws are more stable than tech stacks, but modern stacks are thinly covered.
Discussion
No questions or reviews yet.
Related
PluginsA Claude Code plugin that helps write bug bounty reports from verified facts only, with nothing invented
A marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
Claude Code plugin that audits AI-built apps across five domains with a scorecard and a punch list with file paths.
A code security plugin: finds vulnerabilities, challenges its findings, proves exploitability and fixes with a verified patch
A skill and command bundle for authorized bug bounty and external red-team work in Claude Code: methodology, chain templates and reports
A Claude Code marketplace from Trail of Bits: 29 plugins with hooks and scripts reviewed line by line, from fuzzing and Ghidra to documents
README in short
The README describes a Claude Code plugin built on a large archive of WooYun public business-logic vulnerabilities. The plugin adds real company case references, quantitative statistics and test priorities to the model's answers, without claiming to teach new techniques. There are two install modes: a lite one via the marketplace and a full one via cloning the repository with the complete case database, examples and evaluation sets. Activation happens on explicit security keywords and on implicit black-box scenarios. A responsible-use section limits the tool to authorized testing and research.