{"slug":"utkusen-sast-xxe","source_name":"utkusen/sast-xxe","name":"Utkusen/Sast Xxe","description":"Detect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing sites without external-entity hardening), batched verify (trace user input to each site in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/xxe-results.md. Use when asked to find XXE or XML injection bugs.","version":1,"lift":{"pass_rate_delta_pts":13.64,"pass_rate_pct":86.4,"total_cases":22,"passed_cases":19,"tokens_delta_pct":454.4,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-08-14T01:09:20.437970+00:00"},"skill_score":0.8636,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":13.64,"with_pass_pct":86.4,"without_pass_pct":72.7,"tokens_delta_pct":454.4,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":22,"verdict":"mixed","never_hurt":true,"completed_at":"2026-08-14T01:09:20.437970+00:00","run_id":"dbbc50cd-6531-49dc-ad01-495f148087cd","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":"MIT","install_count":0,"manifest_hash":"306c6a96249790575646422b9b98b86726e176563f32478f9ce493ff470ab28a","raw_url":"https://app.decimal.ai/s/utkusen-sast-xxe/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/utkusen-sast-xxe"}