Is the Security Webshells skill free?

Yes. The skill itself is free from Eyadkelleh/awesome-skills-security. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Security Webshells SkillProof Score?

8.4/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 3/5.

How do I install Security Webshells?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Security Webshells with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Security Webshells

SecLists web-shell samples (PHP/ASP/JSP) as reference files for detection and IDS testing

by Eyadkelleh · Eyadkelleh/awesome-skills-security

Works with setup

Install — copy the command Download source ↗

Test report

Verdict: Works with setup
Score: 8.4/10
Tested: Jul 21, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 7d42f00

Cloned the repo and read SKILL.md at skills/security-webshells/SKILL.md; frontmatter has valid name+description. Verified the referenced references/Web-Shells tree exists with 40 real shell files (30 php, 4 jsp, 4 asp, 1 aspx, 1 cfm), backdoor_list.txt (772 names), and nc.exe which `file` confirms is a PE32 Windows executable. Confirmed payloads are functional (cmd.php: system($_GET['cmd']); simple-shell.jsp: Runtime.exec; obfuscated-phpshell.php: chr-assembled system() gated by md5 password). Docs oversell: description claims Python and Perl shells but find returned zero .py/.pl/.cgi files.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 8/10
Docs & honesty 3/5

What Security Webshells does

Packages a subset of SecLists Web-Shells as loadable reference files: 40 live shell samples across PHP, ASP, ASPX, JSP and CFM, obfuscated variants, CMS-specific shells (Magento/WordPress/Vtiger), and a 772-entry backdoor filename list. Triggers when you ask for web-shell samples to test a WAF/IDS, validate security monitoring, or do malware and forensics research. It also bundles functional command-execution shells and a Windows nc.exe binary, so it should only be installed in an isolated security-research environment.

How to install Security Webshells

git clone --depth 1 https://github.com/Eyadkelleh/awesome-skills-security.git /tmp/security-webshells-src
mkdir -p ~/.claude/skills
cp -R /tmp/security-webshells-src/skills/security-webshells ~/.claude/skills/security-webshells
# WARNING: bundles LIVE web shells (e.g. references/Web-Shells/FuzzDB/cmd.php runs system($_GET['cmd']))
# and a compiled Windows PE binary references/Web-Shells/FuzzDB/nc.exe (PE32 netcat).
# Antivirus/EDR will likely quarantine nc.exe and the PHP/JSP shells on copy, breaking the install.
# Install ONLY in an isolated security-research VM. Content is an MIT-licensed subset of SecLists:
# https://github.com/danielmiessler/SecLists/tree/master/Web-Shells

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Security Webshells

/security-webshells SecLists web-shell samples (PHP/ASP/JSP) as reference files for detection and IDS testing

It also activates on plain-language prompts like these:

Generate a PHP web shell sample for detection testing
Test my WAF against known web shell payloads
Show me an ASPX web shell for security research

Frequently asked questions

Is the Security Webshells skill free?: Yes. The skill itself is free from Eyadkelleh/awesome-skills-security. SkillProof publishes the install command and an independent test verdict at no cost.
Does Security Webshells work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 21, 2026. Verdict: Works with setup. Cloned the repo and read SKILL.md at skills/security-webshells/SKILL.md; frontmatter has valid name+description. Verified the referenced references/Web-Shells tree exists with 40 real shell files (30 php, 4 jsp, 4 asp, 1 aspx, 1 cfm), backdoor_list.txt (772 names), and nc.exe which `file` confirms is a PE32 Windows executable. Confirmed payloads are functional (cmd.php: system($_GET['cmd']); simple-shell.jsp: Runtime.exec; obfuscated-phpshell.php: chr-assembled system() gated by md5 password). Docs oversell: description claims Python and Perl shells but find returned zero .py/.pl/.cgi files.
What is the Security Webshells SkillProof Score?: 8.4/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 3/5.
How do I install Security Webshells?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Security Webshells with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.