Skill UI

A comprehensive playbook for testing XSLT injection vulnerabilities. This guide details advanced attack chains, starting with processor fingerprinting (Java, PHP, .NET, libxslt). It covers critical vectors including XXE (External Entities), Server-Side Request Forgery (SSRF) via document(), arbitrary file writing (EXSLT), and achieving Remote Code Execution (RCE) through language-specific extensions.

A powerful PreToolUse hook designed to act as a safety net during code writing sessions. It automatically scans both file paths and content for 12 common security anti-patterns, including SQL injection, XSS, command injection (Node.js/Python), and unsafe deserialization. It blocks the writing operation and provides immediate warnings, ensuring adherence to secure coding practices when handling sensitive code like authentication or payment logic.

Luna serves as the final quality gate, rigorously reviewing code for objective correctness, security vulnerabilities, and overall reliability. It checks for critical flaws such as injection vulnerabilities, authorization bypasses, race conditions, and adherence to the architectural blueprint. It ensures that only high-quality, safe code progresses to QA and deployment.