Detect server-side template injection across multiple template engines.
npx skills add https://github.com/fatihkan/badi --skill sc-ssti-fatihkan
Please help me install this Agent Skill. Skill: sc-ssti Source: https://github.com/fatihkan/badi/tree/main/.claude/skills/security-check/sc-ssti Command: npx skills add https://github.com/fatihkan/badi --skill sc-ssti-fatihkan
SSTI vulnerabilities allow attackers to execute code by injecting user input into template strings. This Skill provides detection across major template engines to help you identify and remediate these risks before deployment.
Run the SSTI detector against your templates to surface potential injection points across engines.
High-intent search queries and answers about installing and using this skill.
Detect server-side template injection by scanning source files, templates, and rendering paths to identify unsafe user input embedded across major template engines. The analysis enforces discovery rules, semantic checks, and PoC payload evaluation to surface risky patterns before deployment.
Yes, you can scan for SSTI across Jinja2, Twig, Freemarker, Velocity, Pug, Handlebars, ERB, Mako, Thymeleaf, and Go templates. The detection process evaluates rendering paths and verifies potential injection points using targeted PoC payloads across these engines.
Template injection verification works through a phase-based process that combines file pattern scanning, semantic checks on rendering paths, and PoC payload evaluation. This confirms whether unsafe user input embedded in template strings can be executed by the engine.
The best way to remediate unsafe user input in template rendering paths is to apply guided remediation recommendations and adopt safe coding templates. This involves isolating user input from template code and implementing strict rendering rules across your template engines.
Yes, SSTI detection works for polyglot applications by analyzing template code across Python (Jinja2), Java (Freemarker/Velocity), Ruby (ERB), Go, Node.js, and PHP (Twig) services. It surfaces injection points across multiple template ecosystems simultaneously.
Template engines execute injected user input as code when unsafe data is directly embedded into template strings before rendering. This server-side template injection vulnerability allows attackers to manipulate template logic and perform unauthorized code execution.
yhy0Detect and exploit server-side request forgery vulnerabilities in URL parameters.
0xSheTrace user input through PHP template rendering to identify SSTI risks.
JingyueCongIdentify web application vulnerabilities with categories, impacts, and remediation guidance.
blazefluzAudit security, test penetration, and check compliance for the Rentable application.
