通过 Skills CLI 安装
使用 npx skills add 将该 skill 安装到选中的 Agent。Phase 0 命令均为按规则生成，尚未验证。
Codex
npx skills add https://github.com/tanweai/wooyun-legacy/tree/main/plugins/wooyun-legacy/skills/wooyun-legacy -g -a codex -y去掉 -g 可改为项目级安装
#3
该品类排名 #3 / 共 104 个· Ranked #3 of 104 in this category
wooyun-legacy
WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorizati
安装前须知Before you install
!会访问网络Accesses the network
编辑结论· Editor's verdict
把安全评审锚定在真实历史泄漏案例上时它最有用——22000+ 中文互联网历史安全案例，覆盖业务逻辑漏洞、IDOR、竞态条件、设计层数据泄漏。是参考语料，不是扫描器。作为威胁建模输入时最强。当独立扫描器用别选它，实际评审配合 api-security-testing 用。
Best for grounding security review in real-world breach patterns — 22,000+ historical Chinese-internet security cases covering business-logic vulnerabilities, IDOR, race conditions, design-level data leaks. A reference corpus, not a scanner. Strongest as input to a threat-model exercise. Skip it as a standalone scanner; pair with api-security-testing for the actual review.
✓
适合什么场景Best for
- High-star GitHub skill discovery candidate.
✗
不适合什么场景Not for
- Sensitive or production workflows without local review.
vs 其他选择vs alternatives
完整对比表Full compare table →#1api-security-testing
API安全测试的专业技能和方法论
差异 · diffOWASP API Top 10 路径走查最合适——鉴权绕过、对象级授权失效、批量赋值、API 注入面。围绕方法论而不是单纯扫描器。大版本 API 发布前或年度安全评审最有用。基础设施安全（TLS、密钥轮转）别用它，那是另一套工具链。
#2aig-scanner
A.I.G Scanner — AI security scanning for infrastructure, AI tools / skills, AI Agents, and LLM jailbreak evaluation via
差异 · diffAI 特有的失败模式上它最强——Prompt 注入面、过宽工具权限、Agent 逃逸路径、技能供应链风险。能抓传统 app-sec 扫描器漏掉的问题，因为它们不懂 agent 和 skill 是什么。Agent / 技能生态审计最合适。传统 Web 应用渗透别用它，那种场景 api-security-testing 效率更高。
#4threat detection
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers…
差异 · diffUse when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers hypothesis-driven threat hunting, IOC sweep generation, z-score anomaly detection, and MITRE ATT&CK-mapped signal prioritization.
维度对比side-by-side compare
和同类的关键维度差异| 当前 · this skillwooyun-legacy | api-security-testing | aig-scanner | threat detection | |
|---|---|---|---|---|
| 评分 · rating | — | — | — | — |
| 星标 · stars | 1.6k | 3.7k | 3.6k | 14k |
| 风险 · risk | 低风险 · low risk | 中风险 · med risk | 中风险 · med risk | 中风险 · med risk |
| 最适合 · best for | High-star GitHub skill discovery candidate. | API安全测试的专业技能和方法论 | A.I.G Scanner — AI security scanning for infrastructure, AI tools / skills, AI Agents, and LLM jailbreak evaluation via | Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers… |
| 不适合 · not for | Sensitive or production workflows without local review. | 需要比当前目录条目更严格人工复核的工作流。 | 需要比当前目录条目更严格人工复核的工作流。 | 需要比当前目录条目更严格人工复核的工作流。 |
审计备注Audit notes
2026-06-10 复查 · last reviewed源码Source公开 GitHub · open on GitHub✓
作者Author社区贡献 · community!
网络访问Network只读 · read-only✓
文件写入Filesystem工作目录沙箱 · sandboxed✓
依赖Dependencies依赖少且通过审计 · audited✓
遥测Telemetry无 · none✓