SecKnowledge skill
The SecKnowledge skill loads a web-vulnerability and AI-app risk knowledge base into an agent for security testing of a target.
- 446 ★ on the repository
- Last commit
Broad access
Why this level
- Contains working payloads and protection bypass techniques: dual use, apply only to your own systems or with permission.
- The agent may propose actions against a live target, so a human confirms each step.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/secknowledgeDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Contains working payloads and protection bypass techniques: dual use, apply only to your own systems or with permission.
- The agent may propose actions against a live target, so a human confirms each step.
This is third-party code. Review the repository files before installing.
What it does
SecKnowledge is a skill that carries a knowledge base for security testing of web and AI applications. It combines WooYun cases, the Xianzhi L1-L4 methodology, the GAARM matrix of 173 AI risks and OWASP frameworks for LLMs, agents and WSTG. The entry file `SKILL.md` routes the request and the `references/` folder loads the right handbooks: SQL injection, XSS, RCE, file upload, SSRF, CORS, GraphQL, OAuth, plus prompt injection, MCP attacks and sandbox escape. The agent enumerates the target's attack surface, proposes test cases and suggests WAF bypasses. The skill activates when the user names a target and wants it tested or audited.
Who it is for. Penetration testers and developers who audit their own web systems and AI applications and want a reference at the agent's side.
Good fit when
- Planning a test of your own application and enumerating its attack surface.
- A WAF blocks a payload and bypass approaches are needed for an authorized test.
- Checking an AI application for prompt injection, RAG poisoning and MCP abuse.
- Preparing a report that maps findings to OWASP LLM and WSTG.
Not a fit when
- You have no written permission from the target owner.
- You only want an explanation of what XSS or SQL injection is.
- You need a full white-box source audit of a project.
Example request
Draft a plan to test my application for SQL injection and SSRF, list the test cases and mark where a WAF bypass is needed. I am testing my own system, permission granted.Limitations
The skill is reference-only: it scans and executes nothing itself. It contains payloads and protection bypass techniques that may be applied only to your own systems or with explicit permission. The skill description and triggers are in Chinese, and the repository has no license file although a badge says MIT. The last commit was in June 2026. GAARM data is a June 2026 snapshot. The handbooks are large, so the agent loads them through the `SKILL.md` route rather than all at once.
How to disable. Delete the `~/.claude/skills/secknowledge` or `~/.cursor/skills/secknowledge` folder you cloned the repository into.
FAQ
What exactly is in the knowledge base?
Handbooks in `references/`: web vulnerabilities by type, authorization logic, modern protocols, AI risks across five domains and a testing methodology.
When does the skill activate?
When a real test object is given, such as an address, code, a model or an agent architecture, and the goal is testing or audit. Questions like what XSS is do not trigger it.
Does it cover AI applications?
Yes: prompt injection, jailbreaks, RAG and memory poisoning, MCP and skills attacks, sandbox escape.
Can I use it on other people's sites?
No. The material is meant for testing your own systems or with written permission from the owner.
What language are the materials in?
Trigger descriptions in `SKILL.md` and the main documentation are in Chinese, and an English README exists. Read the `references/` handbooks in the original.
Discussion
No questions or reviews yet.
Related
SkillsA practical security skills base for agents: web, API, privilege escalation, Active Directory, mobile, binaries and crypto
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
VibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
Cybersecurity Skills
Cybersecurity Skills for AI Agents
42 security skills for Claude Code, Cursor and Codex: code and cloud audits, authorization-gated pentesting and incident response
A skill for reviewing code for vulnerabilities against OWASP Top 10:2025, ASVS 5.0 and the 2026 lists for LLM and AI agent security
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| SecKnowledge (this card) | no | 446 | |
| WooYun Legacy | no | 1,783 | a plugin on business-logic flaws from the WooYun archive; SecKnowledge is broader: all web vulnerability types plus an AI application risk matrix and OWASP |
| Anthropic Cybersecurity Skills | no | 35,628 | a library of many defense and forensics skills; SecKnowledge is a single routed skill for testing web and AI applications |
README in short
The skill turns general model knowledge into a routed reference. `SKILL.md` holds quick cards and a decision tree, with details in 48 `references/` files.