CtrlK
BlogDocsLog inGet started
Tessl Logo

xxe

Hunt XML External Entity flaws in parsers and validate file read / SSRF impact with strict negative controls.

60

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/xxe/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

72%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is exceptionally concise and well-structured for a simple hunting playbook, but its actionability and workflow clarity are held back by the absence of an executable payload and an explicitly sequenced validation feedback loop.

Suggestions

Add a copy-paste-ready XXE payload XML example (classic and OOB/parameter-entity variants) so the Payloads section is executable.

Turn the flow into a numbered sequence with an explicit validation checkpoint (e.g., 'Confirm positive, then re-run without entity expansion to verify the negative control holds').

Include the concrete disable-feature remediation snippet per parser (e.g., setFeature disallow-doctype-decl) to close the actionability gap.

DimensionReasoningScore

Conciseness

The body is lean with no concept padding — it lists sinks, defaults, payloads, and validation with every token earning its place, assuming Claude's competence.

3 / 3

Actionability

It names concrete sink classes and payload targets, but provides no executable XXE payload XML or remediation code, leaving it copy-paste incomplete rather than fully executable.

2 / 3

Workflow Clarity

Sections imply a find→confirm→exploit→validate flow with positive/negative controls, but there is no explicit numbered sequence, feedback loop, or checklist, so checkpoints remain implicit.

2 / 3

Progressive Disclosure

Under 50 lines with no external references needed and clearly organized sections, satisfying the simple-skill allowance for a top progressive-disclosure score.

3 / 3

Total

10

/

12

Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and occupies a distinctive niche, but it lacks an explicit 'Use when…' trigger clause and the common 'XXE' shorthand, leaving completeness and trigger-term coverage short of the top level.

Suggestions

Add a 'Use when…' clause naming natural triggers (e.g., 'Use when testing for XXE, SSRF via XML, or blind/OOB entity attacks').

Include the abbreviation 'XXE' alongside 'XML External Entity' so the description matches the term users most often say.

Mention common variations like blind/OOB or parameter-entity attacks to broaden trigger-term coverage.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'Hunt XML External Entity flaws in parsers', 'validate file read / SSRF impact', and 'strict negative controls' — matching the multi-action anchor rather than the single-domain level below.

3 / 3

Completeness

The 'what' is strong, but there is no 'Use when…' clause or equivalent explicit trigger guidance, which the rubric caps at 2.

2 / 3

Trigger Term Quality

Contains relevant domain terms ('XML External Entity', 'SSRF', 'file read', 'parsers') but omits the most common abbreviation 'XXE' and variations like blind/OOB that users would naturally say, so it stops short of full coverage.

2 / 3

Distinctiveness Conflict Risk

XXE hunting is a clear, narrow niche with distinct triggers unlikely to collide with other skills.

3 / 3

Total

10

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.