deserialization

Focused insecure deserialization checklist — gadget hints, safe proof, no blind RCE spray.

IndexedMIT★ 1

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/venkatas-deserialization

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Focused insecure deserialization checklist — gadget hints, safe proof, no blind RCE spray.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/deserialization

What's inside

Skill name: deserialization
Description: Focused insecure deserialization checklist — gadget hints, safe proof, no blind RCE spray.
License: MIT
Instructions: 19 lines in SKILL.md · view on GitHub

Files (1)

SKILL.md

SKILL.md (first lines)

# Insecure Deserialization

## Checklist
- [ ] Find typed blobs: `Java` (`rO0`), .NET ViewState, PHP `O:`, Python pickle/`pickle.loads`, Ruby Marshal
- [ ] Cookie / hidden field / queue / cache / session store carriers
- [ ] Library fingerprint before gadget choice (ysoserial / phpggc / similar)
- [ ] Prefer sleep/DNS canary over destructive payloads
- [ ] Check signed/encrypted ViewState MAC before claiming forgeability

## Common bypasses
- Base64 / nested encoding; alternate content-types
- Signing key hard-coded or weak → forge ViewState / JWT-like wrappers
- Polymorphic type discriminators trusting client `class` / `@type` (Jackson/`enableDefaultTyping`)

## Proof standard
- Controlled side effect (time delay, OOB DNS/HTTP, file create in temp) attributable to the payload.
- Do NOT spray public RCE gadgets against production without authorization scope; document canary proof first.

From venkatas/vikramaditya, MIT.

Signals

Stars: 1
Forks: 1
Open issues: 0
Last commit (this folder): Sep 7, 2026 (1 month ago)

From GitHub (fetched Oct 24, 2026).

Details

License: MIT
Repository: github.com/venkatas/vikramaditya
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from venkatas

Cite this page

deserialization skill. Agent Mart. https://agentmart.dev/skills/venkatas-deserialization (last updated 2026-10-24)