Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-inpv-12
Testing for Command Injection
Passed 22 of 22 test cases with the skill, and 21 of 22 without it.
1 fixed21 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
When validating a host parameter in PHP to ensure it contains strictly valid hostname characters before shell execution, what regex pattern enforces alphanumeric characters, hyphens, and dots?
| Checked | Without skill | With skill |
|---|---|---|
| The response provides the regular expression pattern ^[a-zA-Z0-9.-]+$. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-INPV-12
Testing for Command Injection
Command Injection (OS Command Injection) occurs when an application passes unsafe user data to a system shell. Attackers can execute arbitrary operating system commands, potentially gaining full control of the server.
#!/bin/bash
TARGET="https://target.com/api/ping"
echo "[*] Testing for Command Injection..."
# Command injection payloads
PAYLOADS=(
"; id"
"| id"
test cases passed, vs 21 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.