CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-ssti

Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerprinted, escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns documented in disclosed reports. Detection patterns: error messages reveal engine, blank or numeric eval reveals expression mode. Targets: email templates, PDF/report generators, CMS preview features, error pages with user input. Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render.

70

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An actionable, well-structured hunting skill with copy-paste payloads, a clear escalation sequence, and explicit validation guidance. It stays lean and avoids restating basics while covering the main engine-specific paths.

DimensionReasoningScore

Conciseness

Largely efficient payload tables and direct guidance with no padding of concepts Claude already knows; a few explanatory asides (attribute-reflection false negatives, CMS prose) could be trimmed but mostly earn their place.

4 / 5

Actionability

Copy-paste-ready payloads per engine, explicit Content-Type and query-param shapes, and concrete class-walker/Execute snippets cover the common injection cases directly.

5 / 5

Workflow Clarity

A clear numbered 'Order of attack' with a proof/validation checkpoint ('Command output ... confirms RCE') and a referenced pre-severity validation gate, so the destructive-operation cap does not apply; minor gaps remain in explicit error-recovery loops.

4 / 5

Progressive Disclosure

Well-organized sections in a single self-contained file with no bundle directory present and no nested/dead references; slightly above the midpoint because the inline engine tables could in principle be split out, though no bundle is needed at this size.

4 / 5

Total

17

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A precise, third-person description that clearly conveys both the capability (multi-engine SSTI hunting with RCE escalation) and explicit usage triggers. Coverage of engines and concrete techniques is comprehensive.

DimensionReasoningScore

Specificity

Lists multiple concrete actions across engines — 'fingerprint', 'escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns', and detection via 'double-curly and dollar-curly math expressions evaluated server-side' — giving comprehensive coverage.

5 / 5

Completeness

Explicitly states both what it does ('Hunt server-side template injection...') and when to use it ('Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render').

5 / 5

Trigger Term Quality

Strong natural-term coverage ('email templates, PDF/report generators, CMS preview features, error pages', 'when hunting RCE via template rendering') but a few common synonyms/variations a user might voice are absent, so just below the comprehensive anchor.

4 / 5

Distinctiveness Conflict Risk

A clear SSTI niche with engine-specific triggers and a 'Use when' clause scoped to template rendering, minimizing overlap with adjacent RCE/XSS skills.

5 / 5

Total

19

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

relative_links

Relative link issues: 1 missing

Warning

Total

14

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.