# WooYun Legacy for Claude Code: Historical Logic-Vuln Data > WooYun Legacy adds historical WooYun cases, category statistics, and prioritization clues to authorized Claude Code security reviews. It does not teach new attack techniques, its data ends in 2016, and its README states that the project is no longer maintained. **tanweai/wooyun-legacy** — wooyun-legacy skill for claude code - Repository: https://github.com/tanweai/wooyun-legacy - Website: https://wooyun.tanweagent.com/ - Stars: 1,783 · Forks: 360 - Language: Unknown - License: NOASSERTION - Published: 2026-10-16 · Updated: 2026-10-16 · Language: en - Canonical page: https://hysenlabs.com/projects/tanweai-wooyun-legacy ## Why WooYun Legacy Exists for Claude Code Security Work WooYun Legacy addresses a narrow problem: Claude Code can already propose security techniques, but its output may lack historical examples and category-level evidence. The project adds a searchable knowledge layer derived from 22,132 business-logic vulnerability cases collected by WooYun between 2010 and 2016. According to the README, that layer supplies real company case references, quantitative distributions, and ordering clues for test priorities. The intended users are white-hat researchers, security teams, enterprise engineering teams, SRC participants, code auditors, and people performing risk reviews or self-assessments in systems they are authorized to test. The repository does not position itself as an exploitation framework. Its value is narrower and more editorial: it changes an abstract recommendation such as testing payment modification into a report backed by a named historical case, a category count, and a stated high-risk proportion. That distinction matters for adoption. Claude already knows techniques such as changing a submitted amount, examining IDOR, or checking state transitions, according to the project's own comparison. WooYun Legacy does not add those techniques to Claude. It adds historical context and a WooYun-specific vocabulary built around “任意X” patterns such as arbitrary account operation, viewing, modification, deletion, and action. This makes the project more useful as a reference layer for security reports than as a procedural security tool. The repository README begins with a decision not to maintain the project because the authors consider skills less useful as AI capabilities improve. That statement should carry more weight than the absence of GitHub releases. The repository is not archived, and its last push was on 2026-07-14, but that fact does not contradict the maintainers' explicit decision to stop maintaining it. ## How WooYun Legacy Structures Case Data and Claude Context The repository uses a layered data design so Claude can consume methods without always loading the full historical archive. The first layer contains six methodology reference files. The second contains eight technical manuals. The third contains vulnerability categories. The lightweight Marketplace installation keeps 15 condensed category indexes, including case titles, frequent parameters, attack-pattern distributions, and Payload fragments. A full clone retains all 22,132 case records in roughly 71 MB of source data. WooYun Legacy runs as a Claude Code plugin under `plugins/wooyun-legacy`. The repository also exposes `knowledge/`, `categories/`, `examples/`, and `evals/` for direct reading or additional Claude Code loading. With the Marketplace installation, Claude Code is expected to load the plugin when it detects a security-related request. The README describes explicit triggers such as security audit, payment security, authorization bypass, password reset, and business logic, as well as implied requests such as asking whether a parameter can be changed or asking to test an endpoint. The data is used to shape a report, not to execute tests automatically. For an e-commerce review, the README shows that category statistics can lead to checks around order-state transitions, amount modification, and payment bypass. For a multi-tenant SaaS review, it presents IDOR-related subtypes and their historical counts. In a code audit, the historical category is attached to findings such as an unbounded discount calculation or a missing ownership check. This architecture depends on Claude recognizing the task and selecting the relevant reference material. It does not document a standalone API, scanner integration, runtime enforcement agent, or automatic mapping from source code to every WooYun category. The output examples should therefore be read as illustrations of the intended report structure, not as guaranteed responses. ## Installing WooYun Legacy and Verifying Its Claude Code Skill The README recommends the lightweight Marketplace installation for routine testing and report writing. It is approximately 432 KB and retains the core methodology, statistics, condensed indexes, and case fragments. The command adds the repository as a marketplace and then installs the named plugin: ```bash claude plugin marketplace add tanweai/wooyun-legacy claude plugin install wooyun-legacy@tanweai-security ``` After installation, the README says Claude Code automatically loads the plugin when it recognizes a security-related task. The repository does not require an additional configuration file for this mode. A full clone is relevant when the reader needs all 22,132 case records, industry-oriented material under `examples/`, or evaluation data under `evals/`. The documented commands are: ```bash git clone https://github.com/tanweai/wooyun-legacy.git claude --plugin-dir ./wooyun-legacy/plugins/wooyun-legacy ``` The first command creates the local `wooyun-legacy` directory, and the second tells Claude Code to load its plugin for that session. For persistent local installation, the README gives this copy operation: ```bash cp -r ./wooyun-legacy/plugins/wooyun-legacy ~/.claude-personal/plugins/cache/wooyun-legacy ``` Verification is based on Claude Code's skill listing. Enter the following command in Claude Code and look for `wooyun-legacy`: ```text /skills ``` The README also suggests submitting a security-testing question and checking whether Claude cites a WooYun case. That second check is subjective, so the explicit skill listing is the clearer installation signal. ## A First Authorized WooYun Legacy Business-Logic Review A practical first request should identify an authorized system and a bounded workflow. The README gives an e-commerce payment example as a starting prompt: ```text 帮我测试这个电商平台的支付安全，系统有购物车、第三方支付、订单管理和退款流程。 ``` The expected plugin contribution is not a new attack technique. According to the example, Claude should organize the review around payment bypass, amount tampering, order-state changes, and refund logic, then attach historical category counts and examples. The README gives category statistics such as 1,056 payment-bypass cases with 68.7% classified as high risk and 1,227 order-tampering cases with 74.2% classified as high risk. A reviewer should inspect each generated test point for authorization boundaries and evidence quality. Historical prevalence can justify attention, but it cannot prove that the current application is vulnerable. The current code, server-side validation, payment callback behavior, account role, tenant boundary, and observable state transition still determine the result. For report use, preserve the distinction between a historical WooYun pattern and a confirmed finding in the present system. A citation should identify what the old case demonstrates, while the technical evidence should identify what the current assessment actually observed. The README does not define a standardized citation format or a process for validating generated historical references, so reviewers must inspect citations rather than accepting them as automatically correct. This first use is most suitable for report preparation and test-plan design inside an authorized environment. The README does not provide a non-interactive batch command, a CI integration, or an export format for generated reports. ## WooYun Legacy Data Age and Modern Stack Gaps The largest constraint is the source period. WooYun Legacy distills public WooYun data collected from 2010 through 2016. The README directly warns that coverage is limited for modern cloud-native, GraphQL, and Serverless stacks. Its argument that business-logic patterns remain stable is a reason to retain historical checks, but it does not establish equivalent coverage for newer architectures or current framework-specific failure modes. The plugin should be treated as a historical reference, not a current threat model. It can provide examples for client-controlled prices, missing ownership checks, callback abuse, and invalid state transitions. It does not claim complete coverage of current identity systems, infrastructure boundaries, service-to-service authorization, event-driven systems, or contemporary SaaS controls. The GraphQL IDOR example in the README is an illustration of how a historical authorization category may be applied, not evidence that the archive contains GraphQL cases from 2010 to 2016. There is another failure mode: a convincing case citation can be mistaken for proof. The repository's own claim that Claude already passes 98% of its domain-specific assertions without the plugin suggests that the plugin's main effect is evidence presentation and prioritization. The plugin does not replace verification of current controls. The project is also explicitly discontinued by its maintainers. Although the last push was on 2026-07-14, the README says “我们决定不维护了,” meaning the maintainers decided not to maintain it. Users should therefore expect no documented compatibility commitment with future Claude Code releases. The repository has no GitHub releases, so there is no release history here for tracking plugin-specific migrations. ## WooYun Legacy Versus a Conventional Security Knowledge Workflow The practical alternative is to keep the historical WooYun data as a static reference corpus while asking Claude Code to consult selected `knowledge/`, `categories/`, or `examples/` files manually. This is less automatic than the plugin's security-task triggering, but it gives the reviewer explicit control over which evidence enters the context. It also avoids treating automatic activation as proof that Claude selected the correct category. Another alternative is a conventional security review organized around the current application's architecture and controls, with historical cases added only when they match an identified workflow. That approach spends less context on unrelated WooYun categories and requires the tester to establish priority from current threat models, authorization matrices, payment flows, and business invariants. The difference is that WooYun Legacy leads with historical prevalence, while the conventional workflow leads with the target system and uses history as supporting evidence. WooYun Legacy is more focused when the report needs Chinese-language business-logic case references or a repeatable “任意X” classification. The full repository can support retrospective keyword searches across the 22,132 records. Its condensed installation is smaller, but it exposes only selected titles, parameters, distributions, and Payload fragments, so it cannot answer every archive-wide query. License review also requires attention. The README badge identifies CC BY-NC-SA 4.0, while repository metadata classifies the license as custom because the `LICENSE` file requires direct review. The README also places the project in security reporting and SRC contexts. Users should inspect `LICENSE` before redistributing modified case data or incorporating extracts into commercial deliverables. This is a repository-specific compliance check, not legal advice. ## Conclusion Adopt WooYun Legacy only for authorized research, report drafting, or historical analysis when WooYun-style evidence and category statistics add value. Do not treat it as a current vulnerability scanner or a complete method for testing modern cloud-native, GraphQL, or Serverless systems. Before adoption, inspect LICENSE, verify that the 2010-2016 case distribution still represents your target systems, and run a small Claude Code evaluation to confirm that cited cases remain relevant to your code review process. ## FAQ ### Does WooYun Legacy teach Claude Code new penetration-testing techniques? No. The README says Claude already knows techniques such as amount modification, IDOR enumeration, and state-machine skipping. WooYun Legacy mainly adds historical cases, statistics, classification, and prioritization. ### Which WooYun Legacy installation should a typical user choose? The README recommends the Marketplace installation because the lightweight version covers the core methodology, statistics, condensed cases, and prioritization. A full clone is intended for complete case retrieval, `examples/`, `evals/`, and custom analysis. ### Is WooYun Legacy suitable for testing modern GraphQL and Serverless applications? Only as supplementary historical guidance. The README explicitly says its 2010-2016 dataset has limited coverage of cloud-native, GraphQL, and Serverless stacks. ### Will WooYun Legacy continue receiving maintenance? The README states that the maintainers have decided not to maintain it. The repository is not archived and its last push was on 2026-07-14, but no GitHub releases are listed. ## Sources - [Issues](https://github.com/tanweai/wooyun-legacy/issues) - [Project website](https://wooyun.tanweagent.com/) - [README](https://github.com/tanweai/wooyun-legacy/blob/main/README.md) - [tanweai/wooyun-legacy on GitHub](https://github.com/tanweai/wooyun-legacy) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/tanweai-wooyun-legacy