Name: sast-ssrf
Rating: 66.4 (1 reviews)
Author: utkusen

sast-ssrf

Detect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find outbound call sites), batched verify (trace user input to destinations in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/ssrf-results.md. Use when asked to find SSRF or server-side request forgery bugs.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

The canonical home for this skill is sast-ssrf in utkusen/sast-skills

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced SSRF detection workflow with copy-paste subagent prompts and broad language coverage. Its weaknesses are token efficiency and structure: it is a monolithic single file that restates known concepts and inlines reference material that belongs in separate files, and the batch phase lacks a post-batch verification step.

Suggestions

Move the 8-language vulnerable/secure examples and the Phase 1 call-site catalog into separate reference files (e.g. references/examples.md, references/callsites.md) and link to them from SKILL.md to reduce inline token load and improve progressive disclosure.

Add a validation step after Phase 2 batches complete — e.g., review batch findings for classification consistency and completeness before merging — to satisfy the batch-operation feedback-loop requirement and lift workflow clarity above the cap.

Trim the 'What is SSRF' intro paragraph that restates a concept Claude already knows; keep only the skill-specific classification rules (what SSRF is NOT, blocklist caveats, partial-control guidance).

Dimension	Reasoning	Score
Conciseness	The body is mostly actionable reference material, but it opens by restating what SSRF is (a concept Claude already knows) and inlines an exhaustive 11-category call-site catalog plus 8-language examples, so it could be tightened — fitting 'mostly efficient but includes some unnecessary explanation' rather than the lean level 4-5 anchors.	3 / 5
Actionability	Copy-paste-ready subagent prompts with exact output templates, concrete code examples across 8 languages, specific batching commands, and a fully specified merge procedure make the guidance fully executable and cover the common cases, matching the top anchor.	5 / 5
Workflow Clarity	The three phases are clearly sequenced with a Phase 1 zero-candidate checkpoint, but the Phase 2 batch operation has no validation/verification of batch outputs before merge, so per the batch-operation feedback-loop cap workflow clarity cannot exceed 3 despite the otherwise explicit sequence.	3 / 5
Progressive Disclosure	Headers give reasonable structure, but with no bundle files the entire ~530-line body — including the 8-language examples and call-site catalog that clearly belong in separate reference files — is inlined with no one-level-deep references, fitting 'some structure but content that should be separate is inline' rather than a higher level.	3 / 5
	Total	14 / 20 Passed

Description

96%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, third-person description that concretely names the three phases, prerequisites, output, and an explicit trigger clause; it cleanly answers both what and when. The only mild risk is overlap with sibling SAST skills sharing the same 'Detect X vulnerabilities' phrasing.

Dimension	Reasoning	Score
Specificity	The description names multiple concrete actions with sub-detail — 'recon (find outbound call sites), batched verify (trace user input to destinations in parallel subagents, 3 sites each), and merge (consolidate batch results)' — giving comprehensive coverage of what the skill does, matching the top anchor rather than the 'several specific actions; minor gaps' level 4.	5 / 5
Completeness	It explicitly answers both 'what' (three-phase SSRF detection with named phases, prerequisites, and output path) and 'when' ('Use when asked to find SSRF or server-side request forgery bugs') with concrete trigger phrases, fitting the top anchor exactly.	5 / 5
Trigger Term Quality	It includes both the acronym and full term plus a natural user phrasing — 'find SSRF or server-side request forgery bugs' — covering the natural terms a user would actually say, with no meaningful synonyms missing for this domain.	5 / 5
Distinctiveness Conflict Risk	SSRF detection with its own trigger phrase and explicit dependency on sast/architecture.md is a clear niche, but the 'Detect X vulnerabilities in a codebase' pattern risks minor overlap with sibling sast-* skills, fitting 'mostly distinct; minor overlap risk' rather than the level 5 minimal-conflict anchor.	4 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (544 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: utkusen/sast-skills
Path: sast-files/.claude/skills/sast-ssrf/SKILL.md
Commit: db52227

Reviewed: 2 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.