hunt-ssti

Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerprinted, escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns documented in disclosed reports. Detection patterns: error messages reveal engine, blank or numeric eval reveals expression mode. Targets: email templates, PDF/report generators, CMS preview features, error pages with user input. Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable SSTI hunting playbook with concrete payloads and well-sequenced, validated workflows. Its weaknesses are mild payload-matrix repetition that hurts token efficiency and the absence of any progressive-disclosure file structure for a dense, over-50-line skill.

Suggestions

Deduplicate the repeated payload blocks: show the detection matrix and each engine's RCE payload once in the 'SSTI' reference section and have the 'Autonomous Testing Priority' section reference them rather than re-printing them inline.

Extract the 'Related Skills & Chains' section and/or the CMS template-editor deep-dive into a references file (e.g. references/CHAINS.md) and link to it one level deep, so the main body stays a lean overview.

Verify any markdown reference links in the body point to real bundle files before relying on them; currently no references/ or scripts/ bundle exists, so inline cross-references to other skills should be clearly marked as skill-to-skill chains rather than bundle paths.

Dimension	Reasoning	Score
Conciseness	Dense and tactical with no concept-explanation padding, but the Jinja2 RCE payload and the detection matrix each appear in multiple places (priority narrative, RCE Payloads, and Detection Payloads sections), so it could be tightened by deduplicating the repeated payload blocks.	2 / 3
Actionability	Fully copy-paste-ready guidance: per-engine RCE payloads, the exact form-encoded Content-Type and body, Freemarker Execute instantiation, and precise query-param placement (e.g. '?productId=N' with 'csrf=…&template=<PAYLOAD>&template-action=preview').	3 / 3
Workflow Clarity	The numbered 'Order of attack' sequences with explicit feedback loops — fingerprint before firing RCE, re-fetch CSRF and use 'preview' to iterate, switch to 'save' only once the payload is right, command output confirms RCE — provide clear validation checkpoints for a risky operation.	3 / 3
Progressive Disclosure	No bundle files exist and the content is a single ~107-line monolithic playbook with clear section headers but no one-level-deep references; the long 'Related Skills & Chains' section and the deep CMS template-editor dive are inline rather than split into referenced files.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names concrete detection and escalation actions, lists specific target surfaces, and provides an explicit 'Use when...' trigger clause covering both what and when. It is specific, well-triggered, and clearly niched to SSTI.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — detect via double-curly/dollar-curly probes, fingerprint the engine, then escalate to RCE via named patterns (class-walker, callback-registrar, Execute-utility) — plus concrete target surfaces (email templates, PDF/report generators, CMS preview, error pages).	3 / 3
Completeness	Explicitly answers both what (hunt SSTI across named engines, detect, fingerprint, escalate to RCE) and when, with an explicit 'Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render' trigger clause.	3 / 3
Trigger Term Quality	Uses natural domain keywords a tester would actually say — 'SSTI', 'server-side template injection', 'Jinja2/Flask', 'RCE', 'template rendering', 'engine fingerprints' — with good engine-name coverage rather than abstract jargon.	3 / 3
Distinctiveness Conflict Risk	Scoped narrowly to SSTI across specific template engines with template-rendering/engine-fingerprint triggers, a distinct niche unlikely to fire for the sibling hunt-rce/hunt-xss skills despite mild RCE-overlap in framing.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-ssti/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.