## https://sploitus.com/exploit?id=180C97CF-57DD-533C-9A59-03E64D9B79AB
# Vuln-Archive Skill
A [Claude Code](https://claude.com/product/claude-code) skill: This skill allows you to automatically archive vulnerability analysis results, reproduction steps, and code audit findings from sessions—forming a standardized archive consisting of a folder, an analysis report, and a harmless verification PoC. This skill is suitable for authorized penetration testing and security research scenarios.
## Features
When you mention “archiving vulnerabilities,” “organizing vulnerabilities,” or “generating vulnerability reports and PoCs,” the system will automatically perform the following steps:
1. **Collect vulnerability details:** Service name, affected version, cause of the vulnerability, details, and risk level (ask for all details at once if incomplete).
2. **Create a structured archive folder:** `{Service Name}_{Version}_{Vulnerability Cause)`, e.g., `OA_11.6_Any User Login`.
3. **Generate a standard vulnerability analysis report:** Service description, affected version, cause of the vulnerability, code audit process (optional), reproduction steps, and repair suggestions.
4. **Generate a harmless verification PoC:** Parameterized targets, with timeout settings and success criteria consistent with the report.
5. **Self-checking delivery:** Verify that each section of the report, the four elements of the payload (number of packets, URL, complete HTTP packet data, and normal return effect), are complete.
## Installation
```bash
# Personal skill directory (globally available)
git clone https://github.com/InKu0721/Vuln-Archive-Skill.git
cp -r Vuln-Archive-Skill/ ~/.claude/skills/vuln-archive/
# Or copy it to a specific project’s `.claude/skills/vuln-archive/`, and it will only apply to that project.
```
## Usage
After installing, simply say these commands in a Claude Code session:
> Archive this SQL injection vulnerability.
> Organize this deserialization vulnerability and generate a report along with a PoC.
The archiving location can be specified by you; if not specified, the system will ask for instructions and will not automatically archive the files.
## Structure of the archived product
```
{Service Name}_{Version}_{Vulnerability Cause}/
├── VulnerabilityAnalysisReport.md ← Standard analysis report
└── poc.py ← Harmless verification PoC (default is Python; language can be changed based on the scenario)
```
## Safety Guidelines
The PoC generated by this skill follows the principle of “**only verification, no exploitation**”. Verification actions are limited to the type of vulnerability:
| Vulnerability Type | Allowed Verification Actions |
|-------------------|----------------------------------|
| SQL Injection | Only injection of `version()` / `database()` |
| RCE / Command Execution | Only execution of `whoami` / `ifconfig` |
| File Upload | Only uploading and verifying the file |
| Other Types | See [`references/poc-limits.md`](references/poc-limits.md) |
General constraints: Single target, no destruction, no additional data, minimal evidence, and recoverable changes. For complete guidelines, see [`references/poc-limits.md`](references/poc-limits.md).
## File Structure
```
vuln-archive/
├── SKILL.md # Skill definition and workflow
├── README.md
└── references/
├── report-template.md # Vulnerability analysis report template
├── poc-template.py # PoC code template
└── poc-limits.md # Constraints for harmless verification for each vulnerability type
```
## Declaration
This repository only contains methodology and document templates for archiving; it does not contain any actual vulnerability exploitation code. This skill can only be used for legal security testing and research with proper authorization.
[source-iocs-preserved url=https://github.com/InKu0721/漏洞归档技能.git]