A curated collection of essential exploitation payloads and anti-virus test files designed for authorized security validation and bug bounty research.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install payloads
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install payloads using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is SecLists Payloads (Curated)?
SecLists Payloads (Curated) provides a specialized toolkit for developers and security researchers utilizing Openclaw Skills. This skill integrates a high-quality subset of the renowned Daniel Miessler SecLists repository, specifically focused on exploitation payloads. It enables AI coding agents to access standardized strings and files for testing security boundaries, such as file upload vulnerabilities and anti-virus response.
By incorporating this skill into your workflow, you provide your AI agent with the domain-specific knowledge required to simulate real-world attack vectors in a controlled, educational, or professional auditing environment. It bridges the gap between raw security data and actionable agentic workflows.
SecLists Payloads (Curated) Use Cases
- Validating web application firewalls and anti-virus detection using EICAR test files.
- Testing file upload forms for vulnerabilities like path traversal or null byte injection.
- Automating security control validation during the CI/CD pipeline.
- Enhancing bug bounty hunting efficiency with pre-formatted command execution payloads.
- Creating realistic Capture The Flag (CTF) challenges and educational security labs.
How SecLists Payloads (Curated) Works
- The AI agent initializes the skill within the Openclaw Skills framework, gaining local access to the curated payload directory.
- The developer or agent identifies the specific testing surface, such as a file upload endpoint or a terminal input.
- The agent traverses the references/Payloads directory to select the appropriate payload file (e.g., Command execution file names).
- The agent reads the payload content and injects it into the test environment or script for execution.
- Results are logged to verify if the security control successfully blocked the payload or if a vulnerability was exposed.
SecLists Payloads (Curated) Setup
To integrate this skill into your local environment, ensure you have your agent framework configured to recognize Openclaw Skills. Clone or download the payload subset into your references directory:
mkdir -p references/Payloads
# Pull the curated SecLists subset into your project structure
# Ensure the folder is accessible to your AI coding agent
SecLists Payloads (Curated) Data Schema & Taxonomy
The skill organizes payloads into a logical directory structure optimized for programmatic access and discovery:
| Folder/File | Description | Data Type |
|---|---|---|
EICAR test file |
Standardized anti-virus test signatures | Binary/Text |
Null byte file names |
Files designed to test filename handling logic | String List |
Command execution |
Payloads targeting OS command injection | Text Patterns |
Path traversal |
Strings designed to escape directory roots | Text Patterns |
SecLists Payloads (Curated) Advanced Features
- Multi-agent support allowing specialized security agents to share a common payload repository.
- Scriptable directory traversal for automated fuzzing across large payload sets.
- Compatibility with various Openclaw Skills hooks to trigger security scans upon file generation.
- Curated footprint designed for high-performance retrieval without the overhead of the full 4.5 GB SecLists repository.
SKILL.md
Loading
Related Openclaw Skills
Nexudus
A comprehensive integration for managing coworking spaces, memberships, and resource bookings via the Membrane CLI.
Gateway Watchdog
A production-grade bash watchdog designed to ensure the OpenClaw gateway remains highly available through intelligent monitoring and defensive restart logic.
Promote Content Distribution Skill
A multi-platform distribution tool designed to help developers and creators publish tailored content across tech-centric social media and blogging platforms.
find-docs
An authoritative documentation retrieval skill that provides AI agents with real-time access to the latest technical references and code snippets.
index-now
A powerful indexing automation tool to instantly notify major search engines about new or updated web content.
Douyin Downloader Skill
A powerful automated tool for downloading Douyin videos without login requirements using the TikHub API.
Featured*
