Name: injection-checking
Author: yaklang

Imported from yaklang/hack-skills (skills/injection-checking/SKILL.md) via skills.sh. Install upstream with npx skills add yaklang/hack-skills --skill injection-checking. Copyright stays with the author.

Injection Testing Router

This is the routing entry point when input reaches a dangerous interpreter or execution environment.

After confirming this is an injection-class issue, use it to decide whether it is mainly browser context, database, template engine, server-side requests, XML parsing, or system commands.

When to Use

Input reaches HTML, JS, SQL, templates, URL fetchers, XML parsers, or shell
You have not yet decided whether to start with XSS, SQLi, SSRF, XXE, SSTI, CMDi, or NoSQL
You need to choose the correct deep-topic skill based on input flow

Skill Map

Recommended Flow

First identify the final sink of the input
Then choose the topic skill that best matches that interpreter
Small payload samples and quick triage are merged into each main skill; no extra payload router is needed

Related Categories

file-access-vuln

Install injection-checking and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "yaklang-hack-skills-injection-checking", "kind": "skill", "name": "injection-checking", "description": "Entry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on how attacker-controlled input is consumed.", "publisher": "yaklang", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Entry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on how attacker-controlled input is consumed." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/yaklang/hack-skills", "path": "skills/injection-checking/SKILL.md", "ref": "HEAD", "url": "https://www.skills.sh/yaklang/hack-skills/injection-checking", "key": "yaklang/hack-skills/skills/injection-checking/SKILL.md" } }, "instructions": "# Injection Testing Router\n\nThis is the routing entry point when input reaches a dangerous interpreter or execution environment.\n\nAfter confirming this is an injection-class issue, use it to decide whether it is mainly browser context, database, template engine, server-side requests, XML parsing, or system commands.\n\n## When to Use\n\n- Input reaches HTML, JS, SQL, templates, URL fetchers, XML parsers, or shell\n- You have not yet decided whether to start with XSS, SQLi, SSRF, XXE, SSTI, CMDi, or NoSQL\n- You need to choose the correct deep-topic skill based on input flow\n\n## Skill Map\n\n- [XSS Cro", "cost": { "context_tokens": 504 } }

injection-checking

About

Injection Testing Router

When to Use

Skill Map

Recommended Flow

Related Categories

Install injection-checking and it becomes one more candidate the router can pick - when it fits.

Use it

Manifest

Reviews