wooyun-legacy
Provides web vulnerability testing methodology distilled from 88,636 real-world cases from the WooYun vulnerability database (2010-2016). Use when performing penetration testing, security audits, code reviews for security flaws, or vulnerability research. Covers SQL injection, XSS, command execution, file upload, path traversal, unauthorized access, information disclosure, and business logic flaws.
Profile →npx skills add waybarrios/opencode-power-pack --skill wooyun-legacy --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# WooYun Vulnerability Analysis Knowledge Base Methodology and testing patterns extracted from 88,636 real-world vulnerability cases reported to the WooYun platform (2010-2016). --- ## When to Use > All testing described here must be performed only against systems you > have written authorization to test. - Penetration testing web applications - Security code review (server-side or client-side) - Vulnerability research against web targets you have explicit authorization to test - Building security test cases or checklists - Assessing web application attack surface - Reviewing remediation effectiveness - Training or education in authorized security testing contexts ## When NOT to Use - Network infrastructure testing (firewalls, routers, switches) - Mobile application binary analysis - Malware analysis or reverse engineering - Compliance-only assessments (PCI-DSS, SOC2 checklists without testing) - Physical security assessments - Social engineering campaigns - Cloud infrastructure misconfigurations (IAM, S3 buckets) — these require cloud-specific tooling, not web vuln patterns ## Rationalizations to Reject These shortcuts lead to missed findings. Reject them: - "The WAF will catch it
- When to Use
- When NOT to Use
- Rationalizations to Reject
- Core Mental Model
- Attack Surface Mapping
- SQL Injection
- Cross-Site Scripting (XSS)
- Command Execution
- File Upload
- Path Traversal
- Unauthorized Access
- Information Disclosure
- Business Logic Flaws
- Additional Categories
What does the wooyun-legacy skill do?
Provides web vulnerability testing methodology distilled from 88,636 real-world cases from the WooYun vulnerability database (2010-2016). Use when performing penetration testing, security audits, code reviews for security flaws, or vulnerability research. Covers SQL injection, XSS, command execution, file upload, path traversal, unauthorized access, information disclosure, and business logic flaws.
How do I install it?
Run `npx skills add waybarrios/opencode-power-pack --skill wooyun-legacy --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From waybarrios/opencode-power-pack, a repository with 443 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.