# security-fuzzing

Provides curated SecLists fuzzing payloads for injection testing and input validation. Essential for authorized code audits, bug bounties, and CTFs.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 583 installs · ★ 393
- Author: Eyadkelleh
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Eyadkelleh/awesome-skills-security/tree/HEAD/skills/security-fuzzing/SKILL.md
- Updated: 2026-06-08
- HTML: https://affpapa.org/en/nevibecode/skills/security-fuzzing

## What it does

This skill provides a curated subset of fuzzing payloads from Daniel Miessler's SecLists repository. Instead of handling the massive 4.5 GB archive, your coding agent gains targeted test lists. It includes files like `quick-SQLi.txt`, `Generic-SQLi.txt`, `MySQL.fuzzdb.txt`, `NoSQL.txt`, and `command-injection-commix.txt`.

Payloads reside as plain text files inside `references/Fuzzing`. The model can parse these lines to build test cases or verify backend parameter handling.

Use these tests strictly within authorized scopes, such as bug bounties, CTFs, or internal security audits. Applying them to external targets without explicit permission violates standard security policies.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/security-fuzzing/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/security-fuzzing/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/security-fuzzing/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/security-fuzzing/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install Eyadkelleh/awesome-skills-security security-fuzzing
```

2. **Manually: put the files in place**
- File: `.github/skills/security-fuzzing/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/Eyadkelleh/awesome-skills-security --path skills/security-fuzzing
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/security-fuzzing/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add Eyadkelleh/awesome-skills-security --skill security-fuzzing -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/Eyadkelleh/awesome-skills-security/tree/HEAD/skills/security-fuzzing/SKILL.md

## When to use it
- test input fields for command injection vulnerabilities
- verify authentication endpoints against SQL injection bypasses
- fuzz NoSQL database queries with targeted payloads
- check parameter handling using curated SecLists wordlists

## Example prompts
- Run fuzz tests against the login endpoint using payloads from sqli.auth.bypass.txt
- Check input validation on this form using strings from command-injection-commix.txt
- Load NoSQL.txt and generate automated test assertions for the query handler

## Similar
- [fuzzing-dictionary](https://affpapa.org/en/nevibecode/skills/fuzzing-dictionary.md) — skill · 5300 installs
- [fuzzing-obstacles](https://affpapa.org/en/nevibecode/skills/fuzzing-obstacles.md) — skill · 5300 installs
- [injection-checking](https://affpapa.org/en/nevibecode/skills/injection-checking.md) — skill · 3700 installs
- [waf-bypass-techniques](https://affpapa.org/en/nevibecode/skills/waf-bypass-techniques.md) — skill · 3800 installs
- [rust-security](https://affpapa.org/en/nevibecode/skills/rust-security.md) — skill · 544 installs
- [fix-security-vulnerabilities-with-strix](https://affpapa.org/en/nevibecode/skills/fix-security-vulnerabilities-with-strix.md) — skill · 15700 installs

From the same set: [eyadkelleh/awesome-skills-security](https://affpapa.org/en/nevibecode/by/eyadkelleh/awesome-skills-security.md) — 6 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md