security-webshells — Claude Code skill: web shell samples
A set of PHP, ASP, ASPX, JSP, Python and Perl web shell samples for testing detection systems and analysing malware.
npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -a claude-codeWhat security-webshells does
The skill drops a curated slice of the SecLists Web-Shells collection into your agent's context. Five groups sit inside: PHP, ASP/ASPX, JSP, Python and Perl. Reach for it when you are tuning IDS/IPS signatures, checking whether your monitoring catches a shell upload, or walking through a sample in a sandbox.
There is no runtime here. These are reference files, and the agent reads them to help you build a test or annotate a sample. Nothing extra to install beyond the skill itself.
The samples are live malware, so run them on your own box or an isolated lab only. The author spells out the allowed ground: authorised pentesting with written permission, in-scope bug bounty work, CTFs, classroom demos. Everything else is off the table. If you cannot point to who approved the test, skip this one.
What it helps with
- check whether an IDS signature fires on a PHP shell upload
- annotate a web shell sample for an incident report
- build a lab target for file-system monitoring tests
- write a web exploitation challenge for a CTF
- compare how JSP and ASPX shells are structured
Example prompts for the agent
- List the files in the security-webshells skill and group them by language
- Take a PHP sample from the skill and explain which WAF rules would catch it
- Build a monitoring test checklist from the samples in security-webshells
How to install security-webshells
1Skills CLI (Vercel)
npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -a claude-code2Manually: put the files in place
~/.claude/skills/security-webshells/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/security-webshells/
1Skills CLI (Vercel)
npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -a codex2Manually: put the files in place
.agents/skills/security-webshells/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -a cursor2Manually: put the files in place
.cursor/skills/security-webshells/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install Eyadkelleh/awesome-skills-security security-webshells2Manually: put the files in place
.github/skills/security-webshells/SKILL.md1Skills CLI (Vercel)
npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -a gemini-cli2Platform CLI
gemini skills install https://github.com/Eyadkelleh/awesome-skills-security --path skills/security-webshellsManually: put the files in place
.devin/skills/security-webshells/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about security-webshells
How do I install security-webshells in Claude?
Run npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -a claude-code. The skill file then lands at ~/.claude/skills/security-webshells/SKILL.md.
What does security-webshells do?
It gives the agent a collection of web shell samples in PHP, ASP, ASPX, JSP, Python and Perl. They are meant for detection testing, malware analysis and IDS/IPS signature checks.
Can I use these samples against systems I do not own?
No. The skill is scoped to authorised pentesting with written permission, in-scope bug bounty programs, CTFs and educational labs. The author lists everything else as prohibited.
