Injection Checking

This is a P1 category router that helps you triage injection vulnerabilities by looking at where attacker-controlled input actually lands. Instead of guessing whether you're dealing with XSS, SQLi, SSRF, or one of a dozen other injection types, you identify the sink first (HTML, database, XML parser, shell, template engine) and then jump to the appropriate deep-dive skill. It routes to 18 different injection classes including the usual suspects and less common ones like XSLT, CSV formula injection, and prototype pollution. The workflow is simple: spot the dangerous interpreter, pick the matching skill from the map, skip the payload guessing game. Good first stop when you know input is reaching something executable but aren't sure which flavor of injection you're actually hunting.

skills.sh installs: 3.9K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill injection-checking --agent claude-code

Installs into .claude/skills of the current project.

Files

Injection Testing Router

This is the routing entry point when input reaches a dangerous interpreter or execution environment.

After confirming this is an injection-class issue, use it to decide whether it is mainly browser context, database, template engine, server-side requests, XML parsing, or system commands.

When to Use

Input reaches HTML, JS, SQL, templates, URL fetchers, XML parsers, or shell
You have not yet decided whether to start with XSS, SQLi, SSRF, XXE, SSTI, CMDi, or NoSQL
You need to choose the correct deep-topic skill based on input flow