Verified Agent Skill record

Security Arsenal

Security Arsenal is a reference guide containing payloads, probes, bypass patterns, and testing examples for multiple web and application security categories, including XSS, SSRF, SQL injection, XXE, path traversal, IDOR, authentication bypass, NoSQL injection, command injection, SSTI, HTTP smuggling, WebSocket testing, and MFA bypass.

Tasks

Select the relevant documented section for the authorized test case, such as XSS, SSRF, SQL injection, XXE, path traversal, IDOR, authentication bypass, NoSQL injection, command injection, SSTI, HTTP smuggling, WebSocket testing, or MFA bypass.
Use the listed probe or payload pattern against an authorized target, record the request context and observed response, and distinguish detection from impact confirmation.
For conditional findings, document the required chain described in the source, such as desynchronization followed by victim-request capture, administrative traffic, or cache poisoning, without treating the chain as established until observed.

Inputs

An authorized target and test scope.
A selected vulnerability category or bypass pattern.
Observed requests, responses, timing, headers, authentication state, or other test results needed to interpret the documented probes.

Outputs

A categorized test record containing the selected probe or payload, test context, and observed result.
A documented impact chain when the source describes one and the required conditions are demonstrated.
A finding suitable for separate triage and submission review.

Limitations and checks

The document provides payloads, probes, bypass patterns, and testing guidance; it does not establish that any target is vulnerable.
The source states that submittability and the always-rejected or what-not-to-submit decision are owned by triage-validation.
Installation is undocumented: no installation commands or explicit installation procedure are provided.
The source document does not document a supported platform, executable package, automated interface, or required input and output file format.
Claims such as a confirmed vulnerability require observed target behavior; a listed payload alone is not confirmation.
Confirm that testing is authorized and that the selected request, account, endpoint, and data are within scope.
For XSS, verify whether the input reaches the relevant documented source or sink and record execution or non-execution rather than assuming impact from reflection alone.
For SSRF, verify the actual server-side request behavior and distinguish loopback, cloud metadata, internal-service, redirect-chain, and DNS-rebinding tests in the record.