Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-inpv-13
Testing for Format String Injection
Passed 17 of 22 test cases with the skill, and 16 of 22 without it.
2 fixed15 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
A Python application renders user input using `user_input.format(config=secret)`. How should this be refactored to prevent attribute access format injection while preserving string interpolation?
| Checked | Without skill | With skill |
|---|---|---|
| Uses positional template formatting like '{}'.format(user_input). | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-INPV-13
Testing for Format String Injection
Format String vulnerabilities occur when user input is used as the format string argument in functions like printf, sprintf, fprintf (C/C++) or similar functions in other languages. Attackers can read from or write to memory, crash applications, or achieve code execution.
#!/bin/bash
TARGET="https://target.com/api"
echo "[*] Testing for Format String Injection..."
# Format string payloads
PAYLOADS=(
"%s%s%s%s%s"
"%x%x%x%x%x"
test cases passed, vs 16 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.