Local Resources

Name: Local Resources
Author: wgpsec

wgpsec/aboutsecurity

29 installs
1.6k repo stars
Updated July 19, 2026
wgpsec/aboutsecurity

Helps with ai & agent building tasks during AI-assisted development.

About

local-resources is a Claude Code skill for ai & agent building. It helps solo builders move faster with AI-assisted coding.

local-resources
AI & Agent Building
AI-coding skill

Local Resources by the numbers

29 all-time installs (skills.sh)
+2 installs in the week ending Jul 27, 2026 (Skillselion tracking)
Ranked #9,369 of 16,546 AI & Agent Building skills by installs in the Skillselion catalog
Data as of Aug 5, 2026 (Skillselion catalog sync)

npx skills add https://github.com/wgpsec/aboutsecurity --skill local-resources

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/wgpsec/aboutsecurity/local-resources.svg)](https://skillselion.com/skills/wgpsec/aboutsecurity/local-resources)

Installs	29
repo stars	★ 1.6k
Last updated	July 19, 2026
Repository	wgpsec/aboutsecurity ↗

What it does

Helps with ai & agent building tasks during AI-assisted development.

Files

SKILL.mdMarkdownGitHub ↗

本地资源库导航

⚠️ 核心规则：字典统一在 /pentest 目录 — aboutsecurity 字典库和 nuclei 模板库均安装在 /pentest/ 下。

📁 字典库 (Dic/) — 目录爆破 / 密码爆破 / 参数 Fuzz

工具链

# 查看字典库分类
ls /pentest/AboutSecurity/Dic/
# 查看 Web 字典子分类
ls /pentest/AboutSecurity/Dic/Web/
# 使用字典（示例）
spray -u http://target -d /pentest/AboutSecurity/Dic/Web/Directory/Fuzz_common.txt
ffuf -u http://target/FUZZ -w /pentest/AboutSecurity/Dic/Web/Directory/Fuzz_common.txt

常用字典速查表

场景	路径	行数
通用目录爆破	`Web/Directory/Fuzz_common.txt`	~5k
PHP 文件发现	`Web/Directory/php/Fuzz_php.txt`	~48k
PHP Top100	`Web/Directory/php/Top100_php.txt`	~100
CTF URI Fuzz	`Web/CTF/Fuzz_uri.txt`	~220
CTF 参数 Fuzz	`Web/CTF/Fuzz_param.txt`	~44
CTF SQL Fuzz	`Web/CTF/Fuzz_sql.txt`	~94
后台路径	`Web/Directory/Fuzz_admin_dir.txt`	—
API 路径	`Web/Directory/Fuzz_api.txt`	—
备份文件	`Web/File_Backup/`	—
密码 Top100	`Auth/password/top100.txt`	—
DNS 子域名	`Web/dns/`	—

决策树：该用哪个字典？

目标是 Web 应用？
├── CTF/靶场 → Web/CTF/Fuzz_uri.txt（小而精）
├── PHP 站 → Web/Directory/php/Fuzz_php.txt（全面）
├── 通用站 → Web/Directory/Fuzz_common.txt
├── 找后台 → Web/Directory/Fuzz_admin_dir.txt
├── 找 API → Web/Directory/Fuzz_api.txt
└── 找备份 → Web/File_Backup/

目标是认证服务？
├── 密码爆破 → Auth/password/top100.txt
├── 用户名枚举 → Auth/username/
└── 特定服务 → Port/{mysql,ssh,rdp,...}/

📁 Payload 库 — 漏洞验证 payload

工具链

# 查看 aboutsecurity 字典库分类
ls /pentest/AboutSecurity/Dic/
# 查看 nuclei 模板库
ls ~/nuclei-templates/
# 读取具体 payload 文件
cat /pentest/AboutSecurity/Dic/SQL-Inj/bypass-waf.txt

可用分类

SQL-Inj | XSS | LFI | SSRF | XXE | RCE | 403 绕过 | upload | CORS | HPP | SSI

⚠️ 使用外部工具的正确流程

❌ 错误：ffuf -u http://target/FUZZ -w /usr/share/wordlists/common.txt
                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                                        猜测路径，大概率不存在

✅ 正确：
1. ls /pentest/AboutSecurity/Dic/Web/Directory/  → 确认字典存在
2. ffuf -u http://target/FUZZ -w /pentest/AboutSecurity/Dic/Web/Directory/Fuzz_common.txt

💡 高效使用提示

1. spray / ffuf 已封装字典 — 如果只是简单目录爆破，直接用 spray -u target -d wordlist.txt 或 ffuf -u target/FUZZ -w wordlist.txt 2. 自定义参数用 ffuf — 需要自定义参数（如 -e .bak -mc 200）时用 ffuf -u target/FUZZ -w /pentest/AboutSecurity/Dic/... 3. CTF 场景优先用小字典 — Web/CTF/ 下的字典精简且针对性强，避免大字典浪费时间

{
  "skill_name": "local-resources",
  "evals": [
    {
      "id": 1,
      "name": "dict-resolve-ffuf-workflow",
      "prompt": "你需要对 http://target/ 进行 PHP 文件目录爆破，使用 ffuf。你该怎么获取字典路径？",
      "expected_output": "使用 dict_resolve(path=\"Web/Directory/php/Fuzz_php.txt\") 获取绝对路径，然后传给 ffuf -w",
      "expectations": [
        "dict_resolve|dict_list|获取路径",
        "Fuzz_php.txt|php|Web/Directory",
        "ffuf -w|ffuf|dirsearch",
        "绝对路径|实际路径|不要猜测",
        "禁止|不要|/usr/share/wordlists"
      ],
      "required_terms": ["dict_resolve", "ffuf", "Fuzz_php.txt"]
    },
    {
      "id": 2,
      "name": "ctf-dictionary-selection",
      "prompt": "CTF 靶场目标，需要发现隐藏路径。你有多种字典可用，该选哪个？",
      "expected_output": "CTF 场景优先用 Web/CTF/Fuzz_uri.txt（小而精），避免大字典浪费时间",
      "expectations": [
        "CTF|靶场|小字典|精简",
        "Fuzz_uri.txt|Web/CTF|CTF字典",
        "小而精|针对性|避免大字典",
        "brute_dir|dict_resolve|工具",
        "时间|效率|浪费"
      ],
      "required_terms": ["Fuzz_uri.txt", "brute_dir"]
    },
    {
      "id": 3,
      "name": "payload-library-usage",
      "prompt": "你想获取 SQL 注入相关的 payload 文件用于手动测试。该怎么操作？",
      "expected_output": "使用 payload_list() 查看分类，然后 payload_get(category=\"SQL-Inj\", filename=\"xxx.txt\") 获取内容",
      "expectations": [
        "payload_list|payload_get|Payload",
        "SQL-Inj|SQL|注入|分类",
        "category|filename|参数",
        "XSS|LFI|SSRF|其他分类",
        "内容|获取|手动测试"
      ],
      "required_terms": ["payload_list", "payload_get", "SQL-Inj"]
    }
  ]
}

{
  "skill_id": "local-resources",
  "recall_tests": [
    {
      "id": 1,
      "type": "keyword_positive",
      "description": "核心关键词",
      "keywords": [
        "dictionary",
        "wordlist",
        "payload"
      ]
    },
    {
      "id": 2,
      "type": "keyword_positive",
      "description": "工具搜索",
      "keywords": [
        "ffuf",
        "dirsearch",
        "hydra",
        "resource"
      ]
    },
    {
      "id": 3,
      "type": "keyword_negative",
      "description": "不应被report召回",
      "keywords": [
        "报告",
        "修复建议"
      ]
    }
  ],
  "llm_tests": [
    {
      "id": 1,
      "name": "local-resources-scenario",
      "scenario": "需要用 ffuf 进行目录爆破，但不知道字典文件在哪。请搜索本地资源库使用方法。",
      "max_rounds": 2,
      "expect_tool_calls": [
        {
          "tool": "list_skills",
          "keyword_contains": "resource|字典|dictionary|local|wordlist|ffuf|payload"
        },
        {
          "tool": "read_skill",
          "id": "local-resources"
        }
      ]
    }
  ]
}