sast-ssti

Detect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon (find template rendering sites that use dynamic strings), batched verify (trace user input to those sites in parallel subagents, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/ssti-results.md. Use when asked to find SSTI or template injection bugs.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with a clear, well-validated three-phase workflow, but it is token-heavy due to triplicated engine enumerations and is monolithic rather than progressively disclosed into reference files. Actionability and workflow clarity are strong; conciseness and progressive disclosure have clear room to improve.

Suggestions

Consolidate the three overlapping engine lists ('What SSTI IS', 'Phase 1 search patterns', 'Vulnerable vs. Secure Examples') into a single canonical per-engine reference table to cut redundant tokens.

Move the per-engine vulnerable/secure example gallery into a references/ file (e.g. references/engine-examples.md) and have the body point to it, keeping SKILL.md as a lean overview.

In the Phase 1 recon prompt, reference the canonical engine table instead of re-listing all 19 engine patterns inline.

Dimension	Reasoning	Score
Conciseness	At ~595 lines it is mostly efficient but padded: the same engine APIs are enumerated three times — in 'What SSTI IS', again in the 'Phase 1' search list, and again in 'Vulnerable vs. Secure Examples' — so a meaningful share of tokens is redundant. It is tighter than pure concept-padding but could be consolidated.	2 / 3
Actionability	Provides executable vulnerable/secure snippets per engine, exact rendering-call signatures to search for, proof-of-concept payloads, and copy-paste-ready output-format templates, matching the fully-executable anchor.	3 / 3
Workflow Clarity	The three phases are clearly sequenced with an explicit validation checkpoint ('After Phase 1: Check for Candidates Before Proceeding' skips Phase 2/3 on zero candidates), parallel batching rules, and a merge-then-cleanup step — a clear sequence with feedback loops.	3 / 3
Progressive Disclosure	No bundle files exist (references/scripts/assets absent) and all content lives inline in one ~595-line file; the large per-engine enumeration and example gallery are content that could be split into reference files but is not, matching the 'content that should be separate is inline' anchor.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and well-triggered: it names concrete phased actions and gives an explicit 'Use when' clause with natural terms. It is third-person and free of vague fluff. This is a strong, low-conflict description.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'recon (find template rendering sites that use dynamic strings)', 'batched verify (trace user input to those sites in parallel subagents, 3 candidates each)', and 'merge (consolidate batch results)' — matching the anchor for listing multiple specific concrete actions.	3 / 3
Completeness	Clearly answers both 'what' (three-phase detection approach with named phases) and 'when' via the explicit trigger 'Use when asked to find SSTI or template injection bugs.'	3 / 3
Trigger Term Quality	Includes natural user-facing terms — 'SSTI', 'Server-Side Template Injection', and 'template injection bugs' in the explicit 'Use when...' clause — giving good coverage of phrases a user would actually say.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (SSTI detection specifically) with distinct triggers and a stated prerequisite (sast/architecture.md), making it unlikely to fire for the wrong skill.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (607 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: utkusen/sast-skills
Path: sast-files/.agents/skills/sast-ssti/SKILL.md
Commit: db52227

Reviewed: about 19 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.