Is the FFUF Web Fuzzing skill free?

Yes. The skill itself is free from jthack/ffuf_claude_skill. SkillProof publishes the install command and an independent test verdict at no cost.

What is the FFUF Web Fuzzing SkillProof Score?

8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 7/10, docs & honesty 5/5.

How do I install FFUF Web Fuzzing?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use FFUF Web Fuzzing with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

FFUF Web Fuzzing

ffuf pentest guidance plus a working results-analysis and req.txt helper

by jthack · jthack/ffuf_claude_skill

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 8.8/10
Tested: Jul 17, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 8d8e997

Ran the bundled ffuf_helper.py live on a realistic ffuf JSON: it flagged /.git/config, /admin and /backup by keyword and singled out a 900ms /api/v1/users response as a possible SQLi, and its create-req and wordlist subcommands both produced valid output. The skill's mandatory -ac auto-calibration and raw-request IDOR workflow add concrete edge over an unaided baseline that would eyeball the same JSON without the timing-anomaly catch.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 7/10
Docs & honesty 5/5

What FFUF Web Fuzzing does

Expert ffuf guidance for penetration testing: auto-calibration by default, raw-request authenticated fuzzing for IDOR, and a bundled Python helper that scans ffuf JSON for anomalies. Triggers on web fuzzing, directory/subdomain discovery, and analysing ffuf output.

How to install FFUF Web Fuzzing

git clone https://github.com/jthack/ffuf_claude_skill
mkdir -p ~/.claude/skills
cd ffuf_claude_skill && cp -r ffuf-skill ~/.claude/skills/ffuf-web-fuzzing

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger FFUF Web Fuzzing

/ffuf-web-fuzzing ffuf pentest guidance plus a working results-analysis and req.txt helper

It also activates on plain-language prompts like these:

Analyze my ffuf JSON results and flag anomalies like slow SQLi responses
Set up authenticated raw-request fuzzing to find IDOR on this endpoint
Build a wordlist and request file for directory fuzzing this target

Frequently asked questions

Is the FFUF Web Fuzzing skill free?: Yes. The skill itself is free from jthack/ffuf_claude_skill. SkillProof publishes the install command and an independent test verdict at no cost.
Does FFUF Web Fuzzing work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 17, 2026. Verdict: Tested · Works. Ran the bundled ffuf_helper.py live on a realistic ffuf JSON: it flagged /.git/config, /admin and /backup by keyword and singled out a 900ms /api/v1/users response as a possible SQLi, and its create-req and wordlist subcommands both produced valid output. The skill's mandatory -ac auto-calibration and raw-request IDOR workflow add concrete edge over an unaided baseline that would eyeball the same JSON without the timing-anomaly catch.
What is the FFUF Web Fuzzing SkillProof Score?: 8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 7/10, docs & honesty 5/5.
How do I install FFUF Web Fuzzing?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use FFUF Web Fuzzing with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.