Security audit
Security checks for vulnerabilities and agentic risk
This is a clearly labeled dual-use security-testing payload collection with authorization warnings and no hidden execution, persistence, or credential access.
Install this only if you need security-testing payloads and will use them on systems where you have permission. Expect antivirus alerts from the EICAR file and handle the unusual filenames carefully, especially in shell commands or upload tests.
This section documents offensive payloads, including an XSS-enabling SWF and phpinfo/upload-bypass references, with direct example exploit URLs and no safety, authorization, or research-only framing. In an agent skill or reusable repository context, that materially lowers the barrier to misuse by turning the README into actionable attack guidance rather than neutral defensive documentation.
This section enumerates many filename variants specifically intended to bypass upload blacklists and reach executable PHP handling, including edge-case quoting and extension tricks. Providing a curated bypass set in a skill/reference file creates directly reusable attack material for unauthorized file-upload exploitation, which is more dangerous than general security discussion.
No suspicious patterns detected.
