Identify and document XML parsing points vulnerable to XXE across a codebase.
npx skills add https://github.com/utkusen/sast-skills --skill sast-xxe
Please help me install this Agent Skill. Skill: sast-xxe Source: https://github.com/utkusen/sast-skills/tree/main/sast-files/.agents/skills/sast-xxe Command: npx skills add https://github.com/utkusen/sast-skills --skill sast-xxe
This skill helps security teams quickly locate and assess XXE vulnerabilities by systematically analyzing a codebase for XML parsing points that lack explicit hardening against external entities.
Run the XXE detection workflow against a codebase to locate unsafe XML parsing points and verify exploitable paths.
High-intent search queries and answers about installing and using this skill.
To scan for XXE vulnerabilities, this Skill runs a three-phase workflow: reconnaissance to identify XML parsing points, batched verification to trace user input, and a merge phase to consolidate results into sast/xxe-results.md.
The best way to detect unsafe XML parsing points is using a phased static-analysis workflow that systematically locates parsers lacking explicit hardening against external entities and traces exploitable paths.
The XXE detection workflow verifies exploitable parsing points during the batched verify phase, which traces user input to the identified XML parsing locations and documents the findings in sast/xxe-batch-*.md files.
Yes, you need an architecture document to perform XXE code review. This workflow depends on sast/architecture.md to provide necessary context about the tech stack and entry points before identifying XML parsing sites.
Checking a project for XXE vulnerabilities generates markdown artifacts including sast/xxe-recon.md for reconnaissance, sast/xxe-batch-*.md for verification batches, and the final consolidated sast/xxe-results.md report.
Static analysis for XXE requires a phased workflow because locating XML parsing points, verifying user input traces, and consolidating findings across a project architecture demands separate stages to accurately validate exploitable paths.
hieuckAnalyze an unfamiliar codebase and generate an onboarding guide with architecture map and CLAUDE.md.
Kisilev13Detect and exploit XML External Entity vulnerabilities in XML parsers.
truongnatAudits code for OWASP Top 10 vulnerabilities, hardcoded secrets, and unsafe patterns.
dungsnowaxeDetect XXE injection vulnerabilities by injecting malicious XML payloads into endpoints.
