jackson-security
From the author
Security considerations for Jackson JSON deserialization in Java applications. This skill covers common attack patterns such as the Empty Key ("") attack vector, polymorphic type handling, nested injection, and duplicate keys, along with their root causes and recommended mitigation strategies. It provides essential background knowledge and is highly useful for addressing related security vulnerabilities. It is always recommended to invoke this skill before working on relevant security fixes.
Install
npx skills add cxcscmu/SkillLearnBench --skill jackson-security -a claude-code
Installs to .claude/skills/jackson-security/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 83
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- jackson-inject-securitycxcscmu/SkillLearnBenchFixing Jackson @JacksonInject bypass vulnerabilities where attackers use empty JSON keys to override injected values. Use this skill whenever reviewing or patching Java code that uses @JacksonInject for security-sensitive configuration injection, especially in Apache projects.Security★ 91
- jackson-injection-securitycxcscmu/SkillLearnBenchSecurity considerations for Jackson @JacksonInject - preventing JSON input from overriding injected values, covering CVE patterns and defense strategies.Security★ 91
- offensive-deserialization26zl/cybersec-toolkitInsecure deserialization attack checklist: identifying deserialization sinks, Java/PHP/.NET/Python deserialization exploitation, ysoserial gadget chains, magic method abuse, and detection evasion. Use when testing deserialization endpoints or developing deserialization exploits. Use only for authorized security research, training, or assessment.Security★ 82
- 124-java-secure-codingjabrena/plinthUse when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing attack surface via least privilege, applying strong cryptographic algorithms, handling exceptions securely without exposing sensitive data, managing secrets at runtime, avoiding unsafe deserialization, and encoding output to prevent XSS. This should trigger for requests such as Review Java code for secure coding; Find input validation risks in Java code; Review Java code for injection vulnerabilities; Improve secure error handling in Java services; Harden Java code against common security flaws. Part of Plinth ToolkitEngineering★ 455
- exploiting-insecure-deserialization26zl/cybersec-toolkitIdentifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.Security★ 82
- testing-jwt-token-security26zl/cybersec-toolkitAssessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.Security★ 82
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in