hunt-xxe

Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and XXE-to-RCE chains (Adobe Commerce CosmicSting CVE-2024-34102). Use when hunting XXE on any target — emphasis on OOB-Or-It-Didn't-Happen Gate for blind cases.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured hunting skill with concrete payloads, a clear methodology, and strong validation gates. Main weaknesses are inline-heavy organization (no progressive disclosure to reference files) and some explanatory prose that could be trimmed for token efficiency.

Suggestions

Move the payload catalog, parser-ecosystem vulnerability matrix, and disclosed report citations into separate reference files under ./references/ and link to them from SKILL.md, keeping the main file a lean overview with one-level-deep navigation.

Trim the 'Common Root Causes' enumeration and the per-scenario 'Business impact' prose — Claude already understands why XXE is severe; retain only the payload/root-cause specifics that change hunting behavior.

Consolidate the duplicated classic file-read payload that appears in both 'Payload & Detection Patterns' and the bypass sections to reduce token cost and maintenance drift.

Dimension	Reasoning	Score
Conciseness	Mostly efficient reference material (payloads, grep patterns, parser matrix), but the 'Common Root Causes' list and the 'Real Impact Examples' business-impact prose explain impact Claude already understands and could be tightened.	3 / 5
Actionability	Fully executable: copy-paste XML payloads, curl commands for the JSON→XML content-type swap, language-specific grep patterns, and a concrete 10-step methodology with specific endpoints and URI-wrapper schemes — common cases are covered comprehensively.	5 / 5
Workflow Clarity	Clear 10-step hunting sequence with explicit validation checkpoints (Pre-Severity Gate inline-entity probe, Gate 0 Validation) and feedback loops (no-reflection→blind OOB, OOB-blocked→error-based exfiltration), matching the top anchor.	5 / 5
Progressive Disclosure	Well-organized with clear section headers, but ~400 lines are entirely inline with no bundle files in ./references/, ./scripts/, or ./assets/; the payload catalog, parser-ecosystem matrix, and disclosed report citations clearly belong in separate reference files.	3 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly identifies the XXE hunting niche, enumerates concrete vulnerability subtypes, and provides an explicit 'Use when' trigger. The only gap is a few natural synonym triggers ('XML external entity', 'XXE injection') being absent.

Dimension	Reasoning	Score
Specificity	Names the XXE domain plus a comprehensive list of concrete subtypes (SVG-upload, Office-doc PPTX/DOCX, SOAP, SAML AssertionConsumer, blind OOB via DTD callback, parameter-entity, XXE-to-LFI/SSRF/RCE), matching the 'multiple specific concrete actions; comprehensive coverage' anchor.	5 / 5
Completeness	Explicitly states what the skill does (hunts XXE across the listed subtypes) and when to use it ('Use when hunting XXE on any target — emphasis on OOB-Or-It-Didn't-Happen Gate'), satisfying both halves with concrete trigger phrasing.	5 / 5
Trigger Term Quality	Includes the natural trigger term 'hunting XXE' with an explicit 'Use when hunting XXE on any target' clause, but does not spell out synonyms such as 'XML external entity' or 'XXE injection', leaving a few natural variations missing.	4 / 5
Distinctiveness Conflict Risk	Targets a clear niche (XXE specifically) with a distinct trigger phrase and scopes blind cases via the OOB gate; adjacency to hunt-ssrf/hunt-file-upload is acknowledged but the XXE trigger remains unambiguous and low-conflict.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-xxe/SKILL.md
Commit: 0ce18ba

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.