xxe-phantom

SUSPICIOUS/HIGH-RISK offensive security skill. It is internally consistent with its stated XXE exploitation purpose, but that purpose includes active exploitation, OOB exfiltration, credential theft, SSRF against internal services, and RCE chaining. The main risk is not hidden malware but enabling an AI agent to perform high-impact attack workflows using known exfiltration infrastructure and third-party tooling.

This module is a clearly offensive XXE exploitation/probing tool. It crafts payloads that instruct a victim XML parser to read arbitrary local files (defaulting to /etc/passwd) using file:// and php://filter base64 encoding, and it embeds attacker-controlled remote DTD/OOB callback URLs to exfiltrate the file contents via outbound HTTP/FTP interactions. It can also host an attacker-controlled HTTP DTD server (and FTP mode) to receive callbacks, and it can generate malicious SVG/DOCX artifacts for XXE-triggering workflows. While some helper functions are not present in the snippet, the visible payload templates and control flow reflect high-confidence malicious intent.

No executable dependency/library behavior is evident in the provided fragment; it is an offensive XXE exploitation instruction set with attacker-side tooling and OOB infrastructure examples (HTTP/FTP/gopher), including file-read and internal-service interaction patterns. While there is no confirmed embedded malware or obfuscation within this snippet itself, its content strongly enables unauthorized exploitation and sensitive data exfiltration in vulnerable deployments, representing a high misuse/security-risk profile for any supply-chain context where such guidance could be repackaged or distributed.

This fragment contains explicit, ready-to-use XXE exploitation payloads, including local file disclosure (via file:// and XSLT document()), SSRF/internal access (via netdoc://, jar://, and especially gopher://), and a high-impact SSRF-to-Redis chain with embedded state-changing/persistence-oriented directives. The content is strongly indicative of malicious exploitation intent rather than legitimate functionality. If found in a dependency, it should be treated as a severe security threat and removed or quarantined pending provenance and usage verification.

This fragment is a static, attacker-oriented reconnaissance checklist rather than legitimate software logic. It explicitly targets sensitive system/app secrets, SSH private keys, and cloud metadata/token endpoints commonly used for SSRF/LFI/XXE credential theft. While this snippet itself performs no actions, its content strongly suggests support for malicious exploitation and should be treated as a high-risk indicator within a dependency.