SkillsAdd

transilienceai/communitytools

injection

Injection vulnerability testing - SQL, NoSQL, OS Command, SSTI, XXE, and LDAP/XPath injection techniques.

First seen Mar 21, 2026

Installation

$ npx skills add transilienceai/communitytools --skill injection
View on skills.sh ↗ GitHub repository ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

supabase-postgres-best-practices Shared topics
supabase/agent-skills

Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill …

391.6K installs
prisma-cli Shared topics
prisma/skills

Prisma ORM CLI commands reference covering init, generate, migrate, db, dev, complete, studio, …

267K installs
supabase Shared topics
supabase/agent-skills

Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge F…

263K installs
expo-api-routes Shared topics
expo/skills 37.9K installs
golang-dependency-injection Similar name
samber/cc-skills-golang

Comprehensive guide for dependency injection (DI) in Golang. Covers why DI matters (testability…

36.9K installs
sqli-sql-injection Similar name
yaklang/hack-skills

>- SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, f…

3.3K installs

Also in this package

Other skills from transilienceai/communitytools · top by installs.

npx skills add transilienceai/communitytools
attack-path-stitcher 653 hackerone 236 osint 174 reconnaissance 166 cve-poc-generator 152 social-engineering 149 source-code-scanning 142 api-security 141 web-app-logic 139 techstack-identification 137

Browse all from transilienceai/communitytools

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 516
License LICENSE
Default branch main
Open issues 8
Status Active

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 1,694 B
  • docs SUMMARY.md 122 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 134 installs

SKILL.md

Injection

Test for injection vulnerabilities across all input vectors. Covers SQL, NoSQL, Command, SSTI, XXE, and LDAP injection.

Techniques

Type Key Vectors
SQL Injection In-band (union, error), Blind (boolean, time), Out-of-band
NoSQL Injection Operator injection, JavaScript injection, aggregation pipeline
Command Injection OS command separators, blind techniques, out-of-band
SSTI Template engine detection, sandbox escape, RCE chains
XXE Entity expansion, SSRF via XXE, blind XXE, parameter entities
LDAP/XPath Filter manipulation, authentication bypass

Workflow

  1. Identify injection points (parameters, headers, cookies, JSON fields)
  2. Detect injection type with minimal probes
  3. Exploit with context-appropriate payloads
  4. Escalate (data extraction, RCE, file read)
  5. Capture evidence and write PoC

Reference

  • reference/sql-injection*.md - SQL injection techniques
  • reference/nosql-injection*.md - NoSQL injection techniques
  • reference/os-command-injection*.md - OS command injection
  • reference/ssti*.md - Server-side template injection
  • reference/xxe*.md - XML external entity injection
  • reference/ldap-injection-quickstart.md - LDAP filter injection: detection, auth bypass, blind boolean extraction via (description=PREFIX*) chaining
  • reference/xpath-injection-quickstart.md - XPath injection (CWE-643): lxml/Java/Node sinks, ' or '1'='1' or 'a'='b boolean oracle, blind char-by-char extraction recipe