Web Shells

Provides diverse web shell samples in PHP, ASP, ASPX, JSP, Python, and Perl for detection, malware analysis, and security testing under authorized conditions.

This skill is coherent for security research: it bundles many real web‑shell samples intended for detection and testing. That also means the files are inherently malicious if executed. Before installing or using it: (1) only use in authorized, legal contexts; (2) open and inspect files before running anything; (3) perform analysis in an isolated environment (air‑gapped VM, container, or sandbox) that you can destroy afterward; (4) never run samples on production or connected networks; (5) if uncertain about provenance, prefer to obtain the original SecLists repository directly from GitHub; and (6) ensure you have written authorization for any testing against third‑party systems.

Type: OpenClaw Skill Name: web-shells Version: 1.0.0 This skill bundle contains a large collection of functional web shells, backdoors, and exploit samples (e.g., PHP, ASPX, JSP, and ColdFusion shells) sourced from the SecLists repository for security research and detection testing. Key files include 'shell.cfm.html', which contains logic to extract and decrypt database credentials, and 'cmd.sh', a functional CGI-based command execution shell. While the stated purpose is research and the SKILL.md does not contain prompt injection or instructions to harm the host, the presence of ready-to-deploy malware and a 'vulnerable' Vtiger extension (references/Web-Shells/Vtiger/) represents a high-risk 'dual-use' capability that could be easily repurposed for malicious activity.