ssti-server-side-template-injection

Fail

Audited by Socket on Apr 22, 2026

2 alerts found:

SecurityMalware
SecurityMEDIUM
SKILL.md

HIGH risk offensive security skill. Its capabilities are internally consistent with an exploitation playbook, but that stated purpose is to enable AI-driven SSTI exploitation, credential harvesting, and persistence; there is little malware evidence, but the security risk is severe.

Confidence: 95%Severity: 93%
MalwareHIGH
ENGINE_PAYLOADS.md

This artifact is an offensive SSTI exploitation and fingerprinting payload matrix covering many major template engines. It explicitly includes sandbox-bypass guidance, command-execution (RCE) and sensitive file-read payload examples, and blind/OOB verification using attacker-controlled DNS lookups. Even if not directly executable code at runtime, its inclusion in a dependency meaningfully increases misuse capability and represents a high security risk from a supply-chain perspective.

Confidence: 78%Severity: 100%
Audit Metadata
Analyzed At
Apr 22, 2026, 05:05 PM
Package URL
pkg:socket/skills-sh/yaklang%2Fhack-skills%2Fssti-server-side-template-injection%2F@193825e5f503aae72777dc3e03af3939d6f8c19e