WooYun Legacy Business Logic Vulnerability Knowledge Base
Backs AI security reports with 22,132 real WooYun business-logic vulnerability cases, adding citations, quantified statistics, and data-driven test prioritization.
Pure-documentation knowledge skill: no script execution, external calls, network requests, or file writes, so least-privilege risk is inherently low; the repo includes a Responsible Use section (authorized testing only) and a CC BY-NC-SA LICENSE file. Deductions: SKILL.md contains directly usable payloads, default credentials and bypass checklists with no user-authorization confirmation prompt; metadata License is NOASSERTION, inconsistent with the LICENSE file; publisher unverified with no signing or source traceability.
SKILL.md references three layers of files; only references/ is present in the provided sources — Layer 2/3 paths (../../knowledge/, ../../categories/) are unverified, and broken paths would cause load failure. No tests or execution evidence; failure feedback depends entirely on model behavior. Deductions: unverified cross-directory relative paths, no edge-case or failure-mode documentation. Static calibration caps this at 10.
Trigger descriptions are very thorough (explicit keywords, implicit intent, bilingual), Chinese scenarios and localization support are strong, and the README clearly states fit/non-fit ranges and data-vintage limits (2010–2016; limited cloud-native/GraphQL coverage). Deductions: triggers are deliberately extremely broad ('帮我找bug', 'test this endpoint'), risking over-triggering relative to actual capability (knowledge injection, not automated testing); capability boundaries appear only in the README, not the skill file itself.
Well-layered progressive disclosure, install/update/uninstall instructions, bilingual README, complete license text, and data-vintage comments (July 2016, methodology v2.0). Deductions: NOASSERTION license metadata contradicts the LICENSE file; no changelog, version field, named maintainer, or update path; staleness of 2010–2016 data not adequately disclosed inside the skill file itself.
Goals are clear and honest — the README admits Claude already knows the methodology and that the marginal value is real case citations, statistics, and data-driven prioritization. Rich scenarios with directly usable output formats (structured test plans, report templates). Deductions: static review cannot verify actual output quality; incremental value depends on 2010–2016 data applicability to modern systems; the 12 controlled evaluations are author claims only.
The underlying data source (WooYun public disclosure platform, 2010–2016) is auditable public history; case titles, severity percentages, and category files cross-corroborate. Deductions: headline statistics (22,132 cases, percentage rankings) cannot be independently verified in static review; the 12 A/B evaluations are author claims with evals/ not provided alongside the skill; no third-party execution evidence, capped at 5 statically.
- The skill contains directly actionable attack patterns, default-credential lists, and bypass payloads; users must ensure use only on explicitly authorized systems — the skill itself has no built-in authorization confirmation prompt.
- License metadata is NOASSERTION, inconsistent with the repo's CC BY-NC-SA 4.0 (non-commercial); verify licensing compliance before commercial integration.
- Knowledge is based on 2010–2016 WooYun data with limited coverage of cloud-native, GraphQL, and Serverless stacks; treat statistical prioritization as reference, not authority.
- Existence and paths of Layer 2/3 files (knowledge/, categories/) were not verified in this static review; lite vs full install scope differs substantially.
- Triggers are extremely broad (e.g., 'find bugs') and may falsely fire on non-security tasks, consuming context with security methodology.
What does this skill do, and when should you use it?
This is a Claude Code plugin whose knowledge is distilled from 22,132 business-logic vulnerabilities disclosed on the WooYun platform (2010-2016), spanning six domains and 33 vulnerability classes. It does not teach new penetration techniques; instead it arms Claude's existing security-testing ability with real company case citations, quantified severity statistics, and evidence-based test prioritization. It ships a four-phase methodology (business flow mapping, hypothesis formation, targeted manual testing, impact assessment) and a three-tier progressive-loading knowledge structure. Licensed under CC BY-NC-SA 4.0 for authorized testing only, and the project is explicitly no longer maintained.
The skill is a set of structured knowledge documents (SKILL.md plus references/, knowledge/, categories/) with no executable scripts. When triggered it: 1) organizes security testing and code review output around the four-phase methodology — map business flows and trust boundaries, form attack hypotheses from six domain reference files, guide targeted manual testing, then document business impact; 2) ranks test targets by WooYun high-severity ratios (e.g., password reset 88.0%, amount tampering 83.0%); 3) cites real historical cases (e.g., M1905 movie site's 2,588-yuan package bought for 0.5 yuan) and quantified data (1,056 payment-bypass cases, 68.7% high severity); 4) loads progressively in three tiers — domain references, deep-analysis manuals, case library — rather than loading everything at once.
- A penetration tester assessing an e-commerce platform who needs high-severity-ratio-driven prioritization for payment tampering and password-reset tests
- A bug-bounty hunter with limited time (e.g., two days) who wants case statistics to decide which attack surfaces to test first
- A code auditor reviewing an order-placement endpoint who needs a structured report with WooYun pattern classification and remediation guidance
- A security consultant writing client-facing reports who needs real company cases and numbers to persuade non-technical management
- A tester of government/public-service systems focused on localized patterns: weak credentials, payment-callback forgery, ID enumeration
What are this skill's strengths and limitations?
- Grounded in 22,132 real vulnerability cases; quantified data (severity ratios, case counts) feeds directly into reports and prioritization
- Three-tier progressive loading keeps context usage low; the lightweight install (~432KB) covers all core capability
- Ships 12 paired evaluations: assertion pass rate 100% (72/72) with the skill vs 64.6% without
- Covers scenarios familiar to the Chinese-language security community (SRC, government systems, telecom platforms, payment callbacks)
- Recognizes implicit black-box testing intent without requiring explicit security keywords
- The README explicitly declares the project unmaintained — no future updates or fixes
- Knowledge is frozen at 2016 WooYun data; modern stacks (cloud-native, GraphQL, Serverless) are thinly covered
- Licensed CC BY-NC-SA 4.0 (GitHub shows NOASSERTION); commercial product use is prohibited
- Evaluations were run by the project's own authors with no third-party verification, and most metrics measure case injection rather than vulnerability-discovery accuracy
- Average runtime and token consumption increase by roughly 35% and 46% when loaded
How do you install this skill?
Lightweight install (~432KB, recommended): run claude plugin marketplace add tanweai/wooyun-legacy then claude plugin install wooyun-legacy@tanweai-security in a terminal. Alternatively use /plugin marketplace add tanweai/wooyun-legacy and /plugin install wooyun-legacy@tanweai-security inside the Claude Code UI. Full install (~71MB complete case library): git clone https://github.com/tanweai/wooyun-legacy.git, then load a single session with claude --plugin-dir ./wooyun-legacy/plugins/wooyun-legacy, or copy the plugins/wooyun-legacy directory into the plugin cache. Team-wide setup can declare the marketplace and enabledPlugins in the project's .claude/settings.. Verify with /skills in Claude Code. Install steps for other platforms are not documented in the source.
How do you use this skill?
No configuration is needed after installation; the plugin activates in Claude Code on security-related questions. Explicit keywords include penetration testing, IDOR, payment security; implicit phrasings like "test this endpoint", "can I bypass this", or "find bugs" also trigger it. Example prompt: "Help me test the payment security of this e-commerce platform with a cart, third-party payment, order management, and refund flow." Output will include WooYun case citations, statistics, and structured test steps. Use the full install to search the complete raw case library.
How does this skill compare with similar options?
The README positions the plugin as a complement to Claude's built-in security testing, not a replacement: Claude already knows business-logic testing techniques (domain-expertise assertions passed 98% without the skill), so the plugin's value is injecting real cases, statistics, and the WooYun "arbitrary-X" taxonomy absent from training data. No third-party competitors are named.