Name: sast-ssti
Rating: 68 (1 reviews)
Author: utkusen

sast-ssti

Detect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon (find template rendering sites that use dynamic strings), batched verify (trace user input to those sites in parallel subagents, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/ssti-results.md. Use when asked to find SSTI or template injection bugs.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

The canonical home for this skill is sast-ssti in utkusen/sast-skills

Quality

Content

77%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced detection skill with explicit validation checkpoints and checklists, but it is verbose in places and inlines a large pattern/example catalog that belongs in separate bundled reference files.

Suggestions

Trim or remove the 'What is SSTI' conceptual section — Claude already knows SSTI — and keep only the template-string-vs-context distinction that drives detection.

De-duplicate the engine call patterns: list them once in a referenced patterns file (e.g. references/patterns.md) and have Phase 1 point to it, instead of maintaining two parallel lists in the body.

Move the per-language vulnerable/secure examples into a references/examples.md and inline only the project's matched stack, which the skill already does for Phase 2 subagents.

Dimension	Reasoning	Score
Conciseness	The 'What is SSTI' section explains a concept Claude already knows, and the template-engine call patterns are listed twice — once under 'What SSTI IS' and again as Phase 1's 19 numbered search patterns — so the body could be meaningfully tightened.	3 / 5
Actionability	Subagent prompts are copy-paste-ready with exact output formats, concrete per-language grep patterns, a precise batching procedure (3 candidates per subagent), and engine-appropriate payload examples covering the common cases.	5 / 5
Workflow Clarity	Three phases are explicitly sequenced with an embedded validation gate ('After Phase 1: Check for Candidates Before Proceeding' skips Phase 2/3 on zero results), cross-phase dependency notes, and an 'Important Reminders' checklist.	5 / 5
Progressive Disclosure	No bundle files exist, yet the body inlines large reference-style material (a 19-language pattern catalog and vulnerable/secure examples across 10 languages) that would be better split into separate reference files with clearly signaled navigation.	3 / 5
	Total	16 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names a clear niche, lists concrete three-phase actions, and provides an explicit 'Use when' trigger. Minor additional synonyms would push trigger quality and specificity to full marks.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions — 'recon (find template rendering sites that use dynamic strings), batched verify (trace user input to those sites in parallel subagents, 3 candidates each), and merge (consolidate batch results)' — but stops short of the comprehensive multi-action coverage of a 5.	4 / 5
Completeness	Clearly states what it does ('Detect Server-Side Template Injection... using a three-phase approach') and explicitly when to use it ('Use when asked to find SSTI or template injection bugs'), satisfying both halves with a concrete trigger phrase.	5 / 5
Trigger Term Quality	'Use when asked to find SSTI or template injection bugs' gives good natural-term coverage with synonyms (SSTI, template injection), though a few related phrasings users might say are absent.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (SSTI detection) with distinct triggers ('find SSTI or template injection bugs'), making conflict with other skills unlikely.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (607 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: utkusen/sast-skills
Path: sast-files/.claude/skills/sast-ssti/SKILL.md
Commit: db52227

Reviewed: 2 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.