hunt-xxe

Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and XXE-to-RCE chains (Adobe Commerce CosmicSting CVE-2024-34102). Use when hunting XXE on any target — emphasis on OOB-Or-It-Didn't-Happen Gate for blind cases.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable payloads, grep patterns, and a gated, well-sequenced hunting workflow. Its weaknesses are conciseness (chatty root-cause prose and inline time-sensitive claims) and progressive disclosure (a monolithic ~400-line file with no reference bundles despite clearly splittable sections).

Suggestions

Split large sections (payload catalogue, bypass techniques, parser-ecosystem matrix, disclosed report citations) into reference files under references/ and link to them from SKILL.md to improve progressive disclosure.

Trim explanatory root-cause prose and motivational framing (e.g. bounty dollar ranges, 'Developers copy minimal working examples straight into production') to tighten token efficiency.

Isolate time-sensitive claims (year/version statements like 'not universally exploitable in 2026') into a clearly labeled status/deprecation section so inline guidance stays evergreen.

Dimension	Reasoning	Score
Conciseness	Most content is actionable payloads and tables rather than concept fluff, but chatty root-cause prose ('Developers copy minimal working examples straight into production', 'developers assume library handles security') and time-sensitive inline claims ('not universally exploitable in 2026', 'since 2018-2024', CVE-2024-34102) add tokens that don't earn their place; it sits above verbose score-1 but below the lean score-3 anchor.	2 / 3
Actionability	Copy-paste-ready XML payloads, grep one-liners, curl commands, and the inline-entity probe ('<!ENTITY hello "world!">') give fully executable guidance, matching the executable-and-complete anchor rather than the pseudocode score-2 example.	3 / 3
Workflow Clarity	A 10-step numbered methodology is paired with explicit validation gates (Gate 0, Pre-Severity Gate, OOB-Or-It-Didn't-Happen) and feedback loops ('If hello! does NOT echo back... pivot'), satisfying the clear-sequence-with-explicit-validation anchor rather than the missing-checkpoint score-2 anchor.	3 / 3
Progressive Disclosure	There are no bundle files and the ~400-line body is a monolithic wall with payloads, bypass techniques, a parser matrix, and report citations all inline; it is well sectioned but content that should be split into reference files is not, matching the score-2 anchor rather than the one-level-deep-references score-3 anchor.	2 / 3
	Total	10 / 12 Passed

Description

85%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and distinctively scoped to XXE hunting with an explicit 'Use when' trigger and concrete subclass enumeration. Its main weakness is trigger-term coverage: it leans on technical jargon and omits natural language variations a user might actually say.

Suggestions

Add natural-language trigger variations a user would say, e.g. 'XML external entity', 'XML injection', or 'XXE vulnerability', alongside 'XXE'.

Trim insider jargon like 'OOB-Or-It-Didn't-Happen Gate' and 'DTD callback' from the description; move that framing into the body.

Keep the 'Use when...' clause but broaden it slightly so it reads as a natural trigger rather than a process note.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete hunting subclasses ('SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and XXE-to-RCE chains'), matching the multiple-specific-actions anchor rather than the score-2 partial listing.	3 / 3
Completeness	Explicitly answers what ('Hunting skill for xxe vulnerabilities') and when ('Use when hunting XXE on any target — emphasis on OOB-Or-It-Didn't-Happen Gate for blind cases') with a clear 'Use when' trigger, satisfying both clauses rather than the implied-when score-2 anchor.	3 / 3
Trigger Term Quality	The natural user keyword 'XXE' appears ('Use when hunting XXE on any target') but the rest is heavy technical jargon ('OOB-Or-It-Didn't-Happen Gate', 'DTD callback', 'parameter-entity') with no common natural variations like 'XML external entity' or 'XML injection'; it does not reach the broad natural-term coverage of score 3.	2 / 3
Distinctiveness Conflict Risk	Scoped tightly to XXE with named subclasses and an XXE-only trigger, giving a clear niche unlikely to fire for adjacent skills; it is well above the score-2 'could still overlap' anchor.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-xxe/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.