AgentStack
Browse Sign in
Browse Why AgentStack Sell Docs
Sign in
SKILL verified Apache-2.0 Self-run

Opencrow Web Toolbox

skill-02loveslollipop-opencrow-opencrow-web-toolbox · by 02loveslollipop

Use the installed web CTF tooling for endpoint discovery, fuzzing, and automated SQL injection workflows. Use when an agent needs `sqlmap`, `gobuster`, `ffuf`, `dirb`, or `wfuzz`, and when full installs may also include manual Burp or ZAP steps.

↗ Repository
— No reviews yet
0 installs
0 views
— view→install

Install

$ agentstack add skill-02loveslollipop-opencrow-opencrow-web-toolbox

✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • ✓ Prompt-injection patterns
  • ✓ Secret / credential exfiltration
  • ✓ Dangerous shell & filesystem operations
  • ✓ Untrusted network calls
  • ✓ Known-malicious package signatures

What it can access

  • ✓ Network access No
  • ✓ Filesystem access No
  • ✓ Shell / process execution No
  • ✓ Environment & secrets No
  • ✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README, it links to the public security report.

AgentStack Verified badge Links to your public security report.
[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/skill-02loveslollipop-opencrow-opencrow-web-toolbox)

Reliability & compatibility

✓ Security review passed
0 installs to date
— no reviews yet
● today

Declared compatibility

Claude CodeClaude Desktop

Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Opencrow Web Toolbox? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

OpenCROW Web Toolbox

Runtime preflight

Probe required commands with command -v and Python modules with importlib.util.find_spec before use. Prefer a PATH-resolved OpenCROW MCP helper or the ctf/sage environment when available, then the managed helper or system Python. If a capability is missing, stop that path safely and report the exact missing command or module.

Use this skill for web CTF work that starts from discovery and fuzzing rather than browser automation: sqlmap, gobuster, ffuf, dirb, and wfuzz. The full installer profile also tracks manual acquisition steps for Burp Suite Community and OWASP ZAP.

Quick Start

Start the MCP server from the installed CLI:

opencrow-web-mcp

Verify the mapped stack:

python3 scripts/verify_toolkit.py

Workflow

  1. Start with endpoint and content discovery using ffuf, gobuster, or dirb.
  2. Use wfuzz when the problem is parameter fuzzing or more custom request mutation.
  3. Use sqlmap when the challenge is plausibly SQLi-driven and the target is stable enough for automation.
  4. Use playwright separately when the task needs a real browser or a JS-heavy flow.
  5. If a full profile was installed, use the manual Burp/ZAP links from the installer summary for GUI-heavy workflows.
  6. Prefer the MCP server operations first: toolbox_info, toolbox_verify, toolbox_capabilities, web_discover, web_fuzz, and web_sqlmap_scan.

Tool Selection

  • Use ffuf for fast fuzzing against paths, parameters, or virtual hosts.
  • Use gobuster for straightforward wordlist-driven discovery.
  • Use dirb when a challenge guide or prior workflow already assumes DIRB-style usage.
  • Use wfuzz when request templating matters more than raw speed.
  • Use sqlmap when the target and request shape are stable enough to automate.

Resources

  • opencrow-web-mcp: stdio MCP server for typed discovery, fuzzing, and sqlmap workflows.
  • scripts/verify_toolkit.py: confirm that the mapped web discovery tools are installed.
  • references/tooling.md: quick selection notes for web workflows.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet, be the first.

Write a review

Versions

  • v0.1.0 Imported from the upstream source.

More in Databases