skill CX Codex

security-fuzzing — Claude Code skill: what it does, how to install

Q: How do I install security-fuzzing in Claude Code?

Run `npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -a claude-code` in your terminal.

Q: What files are included in this skill?

It provides specific payload lists such as `quick-SQLi.txt`, `sqli.auth.bypass.txt`, `MySQL.fuzzdb.txt`, `NoSQL.txt`, and `command-injection-commix.txt`.

Provides curated SecLists fuzzing payloads for injection testing and input validation. Essential for authorized code audits, bug bounties, and CTFs.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -a claude-code

Open on GitHub

What security-fuzzing does

This skill provides a curated subset of fuzzing payloads from Daniel Miessler's SecLists repository. Instead of handling the massive 4.5 GB archive, your coding agent gains targeted test lists. It includes files like quick-SQLi.txt, Generic-SQLi.txt, MySQL.fuzzdb.txt, NoSQL.txt, and command-injection-commix.txt.

Payloads reside as plain text files inside references/Fuzzing. The model can parse these lines to build test cases or verify backend parameter handling.

Use these tests strictly within authorized scopes, such as bug bounties, CTFs, or internal security audits. Applying them to external targets without explicit permission violates standard security policies.

What it helps with

test input fields for command injection vulnerabilities
verify authentication endpoints against SQL injection bypasses
fuzz NoSQL database queries with targeted payloads
check parameter handling using curated SecLists wordlists

Example prompts for the agent

Run fuzz tests against the login endpoint using payloads from sqli.auth.bypass.txt
Check input validation on this form using strings from command-injection-commix.txt
Load NoSQL.txt and generate automated test assertions for the query handler

How to install security-fuzzing

1Skills CLI (Vercel)

npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -a claude-code

2Manually: put the files in place

~/.claude/skills/security-fuzzing/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/security-fuzzing/

1Skills CLI (Vercel)

npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -a codex

2Manually: put the files in place

.agents/skills/security-fuzzing/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -a cursor

2Manually: put the files in place

.cursor/skills/security-fuzzing/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install Eyadkelleh/awesome-skills-security security-fuzzing

2Manually: put the files in place

.github/skills/security-fuzzing/SKILL.md

1Skills CLI (Vercel)

npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -a gemini-cli

2Platform CLI

gemini skills install https://github.com/Eyadkelleh/awesome-skills-security --path skills/security-fuzzing

Manually: put the files in place

.devin/skills/security-fuzzing/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about security-fuzzing

How do I install security-fuzzing in Claude Code?

Run npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -a claude-code in your terminal.

What files are included in this skill?

It provides specific payload lists such as quick-SQLi.txt, sqli.auth.bypass.txt, MySQL.fuzzdb.txt, NoSQL.txt, and command-injection-commix.txt.

How does this differ from the full SecLists project?

The complete SecLists repository requires 4.5 GB across more than 6,000 files. This skill packages only the core fuzzing text files so your agent stays fast and focused.

Similar skills

Everything for Security →

fuzzing-dictionary trailofbits Generates and connects token dictionaries for parsers and protocols in libFuzzer or AFL++ when coverage stalls on initial checks. CX Codex +1 5,300installs fuzzing-obstacles trailofbits Patches anti-fuzzing patterns like checksums and time-seeded PRNGs in C, C++, and Rust. Useful when fuzzers get stuck on early validation checks. CX Codex +1 5,300installs injection-checking yaklang A router skill for injection testing: pick the right workflow based on where attacker-controlled input ends up. CX Codex +1 3,700installs waf-bypass-techniques yaklang A skill offering WAF evasion methods for injection testing. It guides payload mutation through encoding, chunked requests, and parser discrepancies. CX Codex +1 3,800installs rust-security mohitmishra786 A skill that walks an agent through Rust security work: cargo-audit, cargo-deny, RUSTSEC advisories, safe FFI, fuzzing and Miri. CX Codex +1 544installs fix-security-vulnerabilities-with-strix usestrix This skill triages validated Strix findings, fixes their root causes, and runs Strix again to verify the result. Use it after a CLI or cloud scan. CX Codex +1 15,700installs

From the same set6

security-payloads Delivers curated SecLists attack payloads for testing anti-virus filters and file upload handlers. Built for authorized penetration testers and auditors. CX Codex +1 564installs security-passwords This skill adds curated password wordlists from SecLists to your agent for authorized login audits and credential testing. CX Codex +1 547installs llm-testing A security testing prompt suite to evaluate language models for bias, data leakage, and adversarial bypasses. CX Codex +1 544installs security-webshells A set of PHP, ASP, ASPX, JSP, Python and Perl web shell samples for testing detection systems and analysing malware. CX Codex +1 539installs security-usernames Curated username wordlists from SecLists for user discovery, enumeration, and default credential testing in authorized security assessments. CX Codex +1 537installs