sast-ssrf

Detect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find outbound call sites), batched verify (trace user input to destinations in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/ssrf-results.md. Use when asked to find SSRF or server-side request forgery bugs.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is highly actionable with a clear, gated three-phase workflow and concrete copy-paste prompts. Its main weaknesses are a conceptual preamble that overlaps with existing knowledge and a monolithic structure with no reference-file separation.

Suggestions

Trim or move the "What is SSRF / IS / IS NOT / Patterns That Prevent" conceptual preamble to a reference file; Claude already knows SSRF basics, so keep only the classification-calibrating guidance (e.g., blocklists are not mitigations).

Extract the per-language outbound call-site enumeration and the Phase 1/2 subagent prompt templates into reference files (e.g., references/call-sites.md, references/verify-prompt.md) and link them one level deep from SKILL.md to improve progressive disclosure.

Condense the Important Reminders to the few that are not already stated inline in the phase instructions to reduce token overhead.

Dimension	Reasoning	Score
Conciseness	The operational phases and call-site tables are efficient, but the "What is SSRF / IS / IS NOT / Patterns That Prevent" preamble restates concepts Claude already knows and could be trimmed.	2 / 3
Actionability	Provides concrete per-language call-site lists, copy-paste-ready subagent prompt templates with bracketed substitution, exact batching math (8 sites -> 3 batches), and detailed output-format blocks.	3 / 3
Workflow Clarity	Three phases are explicitly sequenced with a validation gate (skip Phase 2/3 when recon finds zero call sites) and clear ordering constraints reinforced in the Important Reminders.	3 / 3
Progressive Disclosure	A single ~530-line monolith with no bundle files; the per-language call-site enumeration and subagent prompt templates could be split into one-level-deep reference files rather than inlined.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete, well-triggered, and complete, naming specific phases and explicit use-conditions with natural keywords. It is a strong, low-conflict description.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "find outbound call sites", "trace user input to destinations", "consolidate batch results" — matching the anchor for multiple specific concrete actions.	3 / 3
Completeness	Explicitly states what it does (detect SSRF via a three-phase approach) and when to use it ("Use when asked to find SSRF or server-side request forgery bugs"), satisfying both what and when.	3 / 3
Trigger Term Quality	Covers natural terms a user would actually say — "SSRF", "Server-Side Request Forgery", "find SSRF", "server-side request forgery bugs" — including both the acronym and full name.	3 / 3
Distinctiveness Conflict Risk	Targets a clear SSRF-specific niche with distinct triggers, making it unlikely to fire for unrelated security or code skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (544 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: utkusen/sast-skills
Path: sast-files/.agents/skills/sast-ssrf/SKILL.md
Commit: db52227

Reviewed: about 19 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.