Detects and verifies server-side template injection vulnerabilities across major template engines.
npx skills add https://github.com/ersinkoc/security-check --skill sc-ssti
Please help me install this Agent Skill. Skill: sc-ssti Source: https://github.com/ersinkoc/security-check/tree/main/skills/sc-ssti Command: npx skills add https://github.com/ersinkoc/security-check --skill sc-ssti
Server-Side Template Injection (SSTI) vulnerabilities occur when user input becomes part of template code, enabling attackers to execute code or access sensitive data. This Skill helps identify and verify such vulnerabilities across multiple template engines to reduce risk in web applications.
Scan your project for SSTI vulnerabilities across supported template engines with the detector.
High-intent search queries and answers about installing and using this skill.
Server-side template injection detection involves scanning codebases to find where untrusted user input is interpolated into template strings. The tool distinguishes safe data usage from unsafe template code execution across multiple engines using discovery and verification phases.
Vulnerable template engines covered include Python Jinja2, PHP Twig, Freemarker, Velocity, Ruby ERB, Thymeleaf, and Go templates. Engine-specific patterns are applied during discovery and verification to accurately identify server-side template injection risks.
To scan for SSTI, run the detector against your project codebase containing templates and rendering logic. It applies engine-specific patterns across supported languages to surface instances where user input becomes part of template code execution.
Yes, this SSTI scanner supports Java Thymeleaf and Velocity templates. It also covers Python Jinja2, PHP Twig, Freemarker, Ruby ERB, and Go templates, applying engine-specific patterns to verify injection vulnerabilities.
Safe data usage passes user input as variables to templates, while server-side template injection occurs when user input becomes part of template code. The verification phase differentiates the two to produce actionable findings and remediation guidance.
Remediation guidance provides actionable steps to fix server-side template injection vulnerabilities found during verification. It focuses on securing template rendering logic across supported engines like Jinja2, Twig, and Thymeleaf.
yhy0Detect and exploit server-side request forgery vulnerabilities in URL parameters.
josavicentevwAutomate security scanning and governance across CI/CD pipelines and compliance workflows.
kivo360Mitigate security vulnerabilities in CI/CD pipelines using OWASP Top 10 and SAST/DAST workflows.
IndustrialAnalyze code for security vulnerabilities and performance issues.
