hunt-ssti
From the author
Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty.
Install
npx skills add sickn33/agentic-awesome-skills --skill hunt-ssti -a claude-code
Installs to .claude/skills/hunt-ssti/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 95
Security100
Provenance95
Maintenance100
Licence100
Adoption72
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- offensive-sstiSnailSploit/Claude-RedDense description covering Server-Side Template Injection across Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Mako, Handlebars, ERB, Thymeleaf, EJS, Pug. Engine fingerprinting, filter bypass, blind exploitation, WAF evasion, SSTI-to-RCE chains. Tools: tplmap. CWE-1336. MITRE T1190. Use when testing template rendering endpoints or exploiting template injection for code execution.Testing★ 7.7K
- hunt-nodejselementalsouls/Claude-BugHunterHunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/eval injection, template engine SSTI (EJS/Pug/Handlebars), path traversal in file servers, require() injection, environment variable exfil via /proc/self/environ. Use when target runs Node.js/Express/Fastify/NestJS/Koa.Security★ 5.2K
- hunt-lfisickn33/agentic-awesome-skillsHunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path TraversalOther★ 48.2K
- hunt-sqlisickn33/agentic-awesome-skillsHunting skill for sqli vulnerabilities.Security★ 48.2K
- hunt-nosqlielementalsouls/Claude-BugHunterHunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.Other★ 5.2K
- hunt-ldapsickn33/agentic-awesome-skillsHunt LDAP Injection and XPath InjectionOther★ 48.2K
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in