domains / families / security / sast-ssti

sast-ssti

authentic

Detect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon (find template rendering sites that use dynamic strings), batched verify (trace user input to those sites in parallel subagents, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/ssti-results.md. Use when asked to find SSTI or template injection bugs.

When to use

• find SSTI bugs
• find template injection bugs
• detect dynamic template rendering sites
• trace user input to template arguments
• consolidate batch results

When not to use

• XSS via template output
• user input as context data
• static templates with validated filenames
• sandboxed logic-less engines

Skill page

Source