Is Wooyun Legacy safe and trustworthy?

tashan scores Wooyun Legacy on public evidence — it is currently abandoned. Audit scope: OSV advisories, install-time scripts, build provenance and declared permission surface. We do not review source code or execute the capability.

How do I install Wooyun Legacy?

Don't. This capability has been discontinued by its author or publisher and is not scored or recommended. If you are already running it, `npx tashan-cli doctor` will flag it and name what to move to.

Who maintains Wooyun Legacy?

2 GitHub contributors, source: tanweai/wooyun-legacy.

‹ The Index

Wooyun Legacy

plugin

WooYun business logic vulnerability methodology — a security testing knowledge plugin distilled from 22,132 public cases, adding evidence-based references, quantitative statistics, and data-driven prioritization.

Works with: Claude Code (native)
native: this artifact type is that client's own format

Category: Security — see all ranked ›

Work: Security review · Risk assessment

Who it is for: Security engineer · Product manager

Discontinued — do not install. The author's own notice: “不维护决定” It stays listed so anyone already running it can find this page, and so npx tashan-cli doctor can warn about it. It is not scored and does not appear in any ranking.

thin

“Opens with 不维护决定 (declared unmaintained); rich case-backed scenarios follow”

This grade is wrong ›

Looking for a replacement? npx tashan-cli doctor is free and tells you everything above about your whole config. tashan Pro names the replacement — which one, and how it measures. $6/mo.

Instruction depth: 58.0 (thin — shallow — says what it does, not how to actually use it)
Adoption: 1 repos
Freshness: 80.0
Health: abandoned
GitHub stars: 1,741
Contributors: 2
License: NOASSERTION

Security audit

Not scanned yet. We audit npm-published capabilities for known advisories, install-time scripts and permission surface; this one has no npm package we can resolve, or has not reached the queue.

You searched for one. Check the rest of your stack:

npx tashan-cli doctor

Reads the config already on your machine and names what is dead, deprecated or running code at install time. No account, nothing uploaded.

tashan Pro$6/mo

Pro adds the history to tashan doctor, so a run over your own config says which of yours gained an advisory, started running an install script, or lost its last maintainer — and what to move to.

The whole series behind any row, back to the first day we measured it
The replacement, named — not just the news that something died
tashan doctor over your own config, on your own machine

Start a 7-day trial › Everything measured on this page stays free.

source ↗ · plugin:tanweai/wooyun-legacy/wooyun-legacy

Everything on this page is public evidence and free. What it cannot know is whether you run this — check your whole config, free, in the browser. tashan Pro adds the series behind each row and names a replacement for anything dying.

Already running this? Check your whole config — free, in your browser, nothing installed. Or npx tashan-cli doctor locally, which sends nothing at all.

Measured 2026-09-13 · scorer s5 · how · something wrong here?