security-payloads — Claude Code skill: what it does, how to install
Delivers curated SecLists attack payloads for testing anti-virus filters and file upload handlers. Built for authorized penetration testers and auditors.
npx skills add Eyadkelleh/awesome-skills-security --skill security-payloads -a claude-codeWhat security-payloads does
This skill injects attack patterns sourced from SecLists directly into the workspace. It contains the standard EICAR test string, filenames with null bytes, and command execution strings formatted as file names. The agent references these items to probe file upload limits or path traversal weaknesses in application code.
The complete SecLists archive weighs 4.5 GB and spans over 6,000 files. Pulling that entire archive just to run upload tests wastes disk space and slows down indexers. This package provides a focused subset instead. Remember that launching these payloads against third-party systems without written authorization is illegal. Keep usage confined to CTF challenges, scope-compliant bug bounties, or local staging environments.
What it helps with
- verify anti-virus scanner alerts using the EICAR test string
- audit file upload filters against null byte injections
- test file name parsers with embedded system command strings
- validate path traversal safeguards in backend endpoints
Example prompts for the agent
- Use the EICAR sample from security-payloads to draft an upload test suite
- Fuzz our file upload handler with null byte filenames found in references/Payloads
- Inspect the command execution filenames from this skill and check our sanitizer
How to install security-payloads
1Skills CLI (Vercel)
npx skills add Eyadkelleh/awesome-skills-security --skill security-payloads -a claude-code2Manually: put the files in place
~/.claude/skills/security-payloads/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/security-payloads/
1Skills CLI (Vercel)
npx skills add Eyadkelleh/awesome-skills-security --skill security-payloads -a codex2Manually: put the files in place
.agents/skills/security-payloads/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add Eyadkelleh/awesome-skills-security --skill security-payloads -a cursor2Manually: put the files in place
.cursor/skills/security-payloads/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install Eyadkelleh/awesome-skills-security security-payloads2Manually: put the files in place
.github/skills/security-payloads/SKILL.md1Skills CLI (Vercel)
npx skills add Eyadkelleh/awesome-skills-security --skill security-payloads -a gemini-cli2Platform CLI
gemini skills install https://github.com/Eyadkelleh/awesome-skills-security --path skills/security-payloadsManually: put the files in place
.devin/skills/security-payloads/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add Eyadkelleh/awesome-skills-security --skill security-payloads -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about security-payloads
How to install security-payloads in Claude Code?
Run npx skills add Eyadkelleh/awesome-skills-security --skill security-payloads -a claude-code in your terminal.
What does security-payloads do?
It gives AI coding agents access to curated malicious patterns from SecLists, including EICAR test strings and exploit filenames for security validation.
Why use this skill instead of downloading SecLists?
The full SecLists project exceeds 4.5 GB and contains over 6,000 files. This skill packages only the relevant payloads for rapid upload and filter checks.
