security-review-owasp-xml-external-entity-prevention

What problem does it solve?

This Skill helps reviewers find XML External Entity weaknesses that can expose files, trigger SSRF, or cause parser-driven denial of service.

Core Features & Use Cases

• Parser Hardening Review: Checks DTD handling, entity resolution, XInclude, and secure-processing settings across XML parsers and frameworks.
• Downstream Pipeline Analysis: Evaluates validators, transformers, schema loaders, unmarshallers, and XPath consumers for unsafe external fetch behavior.
• Security Review Workflow: Separates confirmed vulnerabilities from review gaps and produces evidence-based findings with remediation guidance.
• Use Case: Review an authentication or webhook XML flow to confirm whether untrusted input can reach an unsafe parser or downstream consumer.

Quick Start

Ask the skill to review the XML parsing flow, related configuration, and any downstream consumers for XXE exposure and unsafe external fetches.