Server-Side Template Injection (SSTI) (offensive-ssti)

Authorization & Scope Notice: This skill is part of the REA_Skill + claude-red Unified Security & Reverse Engineering Suite. It is designed strictly for authorized security assessments, defensive architecture reviews, vulnerability triage, bug bounty verification, and remediation engineering on software, infrastructure, and assets you own or have explicit permission to test.

Overview

Server-side template injection (SSTI) assessment covering Jinja2, Twig, Freemarker, Velocity, Pebble, Handlebars, and EJS template engines, context identification, sandbox escape analysis, and logic-less template remediation. Use when user input is concatenated into template strings or dynamic email/page rendering.

Operational Workflow