Remote Code Execution Testing Checklist

What it does

This skill gives an AI agent a detailed security-testing checklist for remote code execution (RCE), a serious class of bug where an attacker can run their own commands on a server. Once installed, when a conversation touches on topics like command injection, template injection or unsafe deserialization, the agent follows the checklist: it maps where user input enters an app, suggests test payloads for each context, and proposes harmless confirmation steps such as running whoami or a short sleep. It is aimed at authorised penetration testing and bug bounty work, and the file itself is a reference of attack techniques rather than a tool that scans anything.

Try asking

• “Walk me through an RCE checklist for this Flask app's template rendering, starting with input mapping.”Copy
• “Which command injection payloads should I try against this Linux endpoint that passes user input to ping?”Copy
• “Review this YAML loading code for unsafe deserialization risks and suggest safer alternatives.”Copy
• “Help me track which RCE checklist items I've completed for our authorised pentest of the staging site.”Copy

Get better results

• Only use this on targets you are explicitly authorised to test, and state the scope and authorisation in your request so the agent keeps its suggestions within it.
• Give the agent concrete context such as the framework, language and input location; it applies the checklist more usefully when it knows the target.
• Ask the agent to explain why each payload would work and what a positive result looks like, so you can verify findings rather than trusting raw output.

What's inside

• SKILL.md