wooyun-legacy

🥈Silver

wooyun-legacy skill enables Claude to analyze and identify vulnerabilities using a database of 88,636 real-world security flaws. Security teams and developers benefit from automated vulnerability assessment, threat modeling, and secure code review. It connects to code repositories and CI/CD pipelines for proactive security checks.

1,5542210Updated Today

Intermediate30min to implementautomation

Saves ~45 min per use

Quick InstallView Source

git clone https://github.com/tanweai/wooyun-legacy.git

Works with:

Claude

Overview

About This Skill

How to Use

[{"step":"Prepare your environment","action":"Ensure the wooyun-legacy skill is enabled in your AI assistant. Clone the target repository locally or provide the repository URL if the skill supports remote analysis.","tip":"For large repositories, pre-filter files to scan (e.g., focus on `src/` or `app/` directories) to reduce analysis time."},{"step":"Customize the prompt","action":"Replace [LANGUAGE], [REPO_PATH], [VULNERABILITY_TYPES], and [SEVERITY_CRITERIA] in the prompt template to match your needs. For example, use `[LANGUAGE]=JavaScript` and `[VULNERABILITY_TYPES]=prototype pollution, prototype tampering`.","tip":"Use specific vulnerability types (e.g., 'buffer overflow') rather than broad categories (e.g., 'memory issues') for more precise results."},{"step":"Run the analysis","action":"Paste the customized prompt into your AI assistant (e.g., Claude or ChatGPT) and execute it. The skill will scan the codebase and generate a vulnerability report.","tip":"For CI/CD integration, use the skill in a script (e.g., Python) to automate scans on code changes. Example: `wooyun-legacy scan --repo /path/to/repo --language python`."},{"step":"Review and act on findings","action":"Examine the report for false positives (e.g., benign code patterns) and prioritize vulnerabilities based on severity. Use the remediation steps and code snippets to fix issues.","tip":"Cross-check high-severity findings against the CVE database (e.g., `CVE-2023-45678`) to confirm if they match known exploits."},{"step":"Integrate into workflow","action":"Add the wooyun-legacy skill to your CI/CD pipeline (e.g., GitHub Actions, GitLab CI) to run scans on every pull request. Configure it to block merges if critical vulnerabilities are detected.","tip":"Set up notifications (e.g., Slack, email) for new vulnerabilities found in production code."}]

Use Cases

Analyze SQL injection vulnerabilities in your web applications.

Identify and mitigate command execution risks in your software.

Educate your team on common security flaws like XSS and unauthorized access.

Perform authorized security assessments using real-world vulnerability data.

Setup & Installation

Quick Install

No install command available. Check the GitHub repository for manual installation instructions.

Alternative Install (Git Clone)

git clone https://github.com/tanweai/wooyun-legacy

Requirements

Claude Code or compatible AI agent
Works with: Claude

Quick Start Guide

Install the Skill

Copy the install command above and run it in your terminal.

Open Your AI Agent

Launch Claude Code, Cursor, or your preferred AI coding agent.

Try It Out

Use the prompt template or examples below to test the skill.

Customize

Adapt the skill to your specific use case and workflow.

Usage Examples

Prompt Template

Analyze the [LANGUAGE] codebase in [REPO_PATH] for vulnerabilities using the wooyun-legacy skill. Focus on [VULNERABILITY_TYPES, e.g., SQL injection, XSS, buffer overflows] and prioritize findings based on [SEVERITY_CRITERIA, e.g., CVSS score, exploitability]. Generate a report with remediation steps for each vulnerability, including code snippets where applicable. Cross-reference findings with the CVE database to confirm if any match known exploits (CVE-[YEAR]-[ID]).

Example Output

### Security Vulnerability Assessment Report
**Repository Analyzed:** `acme-corp/web-app (v2.1.4)`
**Analysis Date:** 2023-11-15
**Total Vulnerabilities Found:** 12 (High: 3, Medium: 5, Low: 4)

#### Critical Findings:
1. **SQL Injection in `src/db/user_queries.py` (Line 42)**
   - **Vulnerability:** Dynamic SQL query construction using user input without parameterization.
   - **Evidence:** The `get_user_by_email()` function concatenates raw input into a SQL query:
     ```python
     query = f"SELECT * FROM users WHERE email = '{email}'"
     ```
   - **CVSS Score:** 9.8 (Critical)
   - **Exploitability:** Confirmed via proof-of-concept (PoC) using Burp Suite. Attacker can dump the entire `users` table.
   - **Remediation:** Use parameterized queries:
     ```python
     query = "SELECT * FROM users WHERE email = %s"
     cursor.execute(query, (email,))
     ```
   - **Reference:** CVE-2023-45678 (Patched in v2.1.5)

2. **Hardcoded API Key in `config/prod.env` (Line 7)**
   - **Vulnerability:** Plaintext AWS access key exposed in version control.
   - **Evidence:** Key `AKIAIOSFODNN7EXAMPLE` found in Git history (commit `a1b2c3d`).
   - **CVSS Score:** 7.5 (High)
   - **Risk:** Potential for cloud resource hijacking.
   - **Remediation:** Rotate the key immediately and use AWS Secrets Manager. Add `.env` to `.gitignore`.

#### Medium Findings:
- **Cross-Site Scripting (XSS) in `templates/login.html`:** Unsanitized user input in the `welcome` message. Suggest using a templating engine like Jinja2 with auto-escaping.
- **Insecure Deserialization in `src/utils/serializer.py`:** Use of `pickle` module for user input. Replace with JSON or a safer alternative.

#### Low Findings:
- **Missing Security Headers:** `Content-Security-Policy` and `X-Content-Type-Options` headers not set. Add them via middleware (e.g., Flask-Talisman).

**Recommendations:**
1. Prioritize fixes for the SQL injection and hardcoded key vulnerabilities. Deploy patches within 24 hours.
2. Run a full regression test after applying remediations.
3. Schedule a follow-up scan after deploying fixes to confirm resolution.

**Next Steps:**
- Open Jira tickets for each critical vulnerability (e.g., `WEB-456` for SQLi).
- Update the CI/CD pipeline to include wooyun-legacy scans on every pull request.

**Confidence Level:** High (95%). All findings were cross-verified against the wooyun-legacy database and manual testing where applicable.