Agent Skills
› yaklang/hack-skills
› injection-checking
injection-checking
GitHub注入测试路由入口，根据攻击输入的最终消耗环境（如浏览器、数据库、模板引擎等）自动路由至对应的具体注入漏洞检测技能。
Trigger Scenarios
需要确定具体的注入类型（XSS, SQLi等）
输入到达危险解释器或执行环境
Install
npx skills add yaklang/hack-skills --skill injection-checking -g -y
SKILL.md
Frontmatter
{
"name": "injection-checking",
"description": "Entry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on how attacker-controlled input is consumed."
}
Injection Testing Router
This is the routing entry point when input reaches a dangerous interpreter or execution environment.
After confirming this is an injection-class issue, use it to decide whether it is mainly browser context, database, template engine, server-side requests, XML parsing, or system commands.
When to Use
- Input reaches HTML, JS, SQL, templates, URL fetchers, XML parsers, or shell
- You have not yet decided whether to start with XSS, SQLi, SSRF, XXE, SSTI, CMDi, or NoSQL
- You need to choose the correct deep-topic skill based on input flow
Skill Map
- XSS Cross Site Scripting
- SQLi SQL Injection
- SSRF Server Side Request Forgery
- XXE XML External Entity
- SSTI Server Side Template Injection
- CMDi Command Injection
- NoSQL Injection
- Deserialization Insecure
- JNDI Injection
- Expression Language Injection
- CRLF Injection
- Extra Injection Types (SSI, LDAP, XPath)
- Request Smuggling
- Prototype Pollution
- Type Juggling
- HTTP Parameter Pollution
- XSLT Injection
- CSV Formula Injection
Recommended Flow
- First identify the final sink of the input
- Then choose the topic skill that best matches that interpreter
- Small payload samples and quick triage are merged into each main skill; no extra payload router is needed
Related Categories
Version History
- c9a4b9e Current 2026-07-06 00:23
