php-ssrf-xxe-audit

Name: php-ssrf-xxe-audit
Availability: InStock
Author: yunmengya

Audit SSRF and XXE vulnerabilities in PHP codebases with evidence-based findings.

80|6|Updated Feb 27, 2026

Search Tags:#security #vulnerability #php #audit #ssrf #xxe

Ready to run

npx skills add https://github.com/yunmengya/PHP_AUDIT_SKILLS --skill php-ssrf-xxe-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: php-ssrf-xxe-audit
Source: https://github.com/yunmengya/PHP_AUDIT_SKILLS/tree/main/php-ssrf-xxe-audit
Command: npx skills add https://github.com/yunmengya/PHP_AUDIT_SKILLS --skill php-ssrf-xxe-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical security vulnerabilities of Server-Side Request Forgery (SSRF) and XML External Entity (XXE) attacks within PHP applications, providing evidence-based findings.

Core Features & Use Cases

SSRF & XXE Detection: Identifies potential SSRF and XXE vulnerabilities by analyzing URL handling and XML parsing functions.
Evidence Chain Tracking: Records the complete path from input to sink, detailing sanitization and filtering logic.
Use Case: When auditing a PHP e-commerce platform, this Skill can pinpoint if user-supplied URLs in product import features could be exploited for SSRF, or if XML-based payment gateway integrations are vulnerable to XXE attacks.

Quick Start

Use the php-ssrf-xxe-audit skill to audit SSRF and XXE risks in the provided PHP project.

Frequently Asked Questions about php-ssrf-xxe-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit PHP code for SSRF and XXE vulnerabilities?▼

Auditing PHP code for SSRF and XXE vulnerabilities involves locating URL and XML parsing functions, tracing input controllability, and identifying filtering logic to generate evidence-based findings in JSON and Markdown.

What is the best way to trace user input to XML parsing functions for XXE attacks in PHP?▼

The best way to trace user input to XML parsing functions for XXE attacks in PHP is by recording the complete path from input to sink and detailing sanitization logic to produce evidence-based findings.

Can I verify SSRF findings from PHP codebases in a Docker environment?▼

Yes, you can verify SSRF findings from PHP codebases in a Docker environment, as the audit generates specific debug verification steps to validate evidence chains within Docker.

Does the SSRF and XXE audit generate reports in JSON and Markdown?▼

Yes, the SSRF and XXE audit generates evidence-based findings in both JSON and Markdown formats to document security vulnerabilities and evidence chains.

How do I identify if user-supplied URLs in PHP e-commerce platforms can be exploited for SSRF?▼

To identify if user-supplied URLs in PHP e-commerce platforms can be exploited for SSRF, you analyze URL handling functions and trace input controllability to pinpoint potential exploitation paths.

What limitations exist when auditing XML-based payment gateway integrations for XXE risks in PHP?▼

Limitations when auditing XML-based payment gateway integrations for XXE risks in PHP depend on the completeness of evidence chain tracking and the accuracy of filtering logic identification within the codebase.