Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add adriannoes/awesome-agentic-ai --skill hunt-xxegit clone --depth 1 https://github.com/adriannoes/awesome-agentic-aiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/adriannoes/awesome-agentic-ai/hunt-xxe)<a href="https://agentmods.dev/skills/adriannoes/awesome-agentic-ai/hunt-xxe"><img src="https://agentmods.dev/badge/skills/adriannoes/awesome-agentic-ai/hunt-xxe/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/adriannoes/awesome-agentic-ai/hunt-xxe"><img src="https://agentmods.dev/badge/skills/adriannoes/awesome-agentic-ai/hunt-xxe.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.04623 |
| Opus 5 | $0.00015 | $0.02312 |
| Sonnet 5 | $0.00006 | $0.00925 |
| Haiku 4.5 | $0.00003 | $0.00462 |
Grade A, and why
hunt-xxe scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 367 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Crown Jewel Targets
XXE is a critical-severity vulnerability that consistently pays at the top of bug bounty scales ($5,000–$30,000+) due to its direct path to sensitive data exfiltration and SSRF. Highest-value targets:
- Large enterprise platforms with XML-heavy backend integrations (finance, logistics, ride-sharing APIs)
- Domains with file-read capability —
/etc/passwd,/etc/shadow, internal config files, AWS metadata endpoints - Subdomains sharing backend infrastructure — one XXE endpoint can pivot to internal services across dozens of domains (as demonstrated by 26+ Uber domains via a single entry point)
- API gateways accepting XML content types — especially REST APIs that silently accept
Content-Type: application/xml - File upload features — SVG, DOCX, XLSX, PDF, PPTX parsers on the server side
- SAML/SSO endpoints — SAML assertions are XML-based and frequently vulnerable
- Office/document processing services — any feature that converts or processes user-supplied documents
Attack Surface Signals
URL Patterns
/api/v*/xml
/upload
/import
/parse
/convert
/saml/acs
/sso/saml
/feed
/rss
/sitemap
/webdav
/soap/*
/wsdl
/service.asmx
/xmlrpc
/graphql (multipart with XML)
Request/Response Headers
Content-Type: application/xml
Content-Type: text/xml
Content-Type: application/soap+xml
Content-Type: multipart/form-data ← check file upload fields
Accept: application/xml
X-Content-Type-Options: (absent — good sign of loose parsing)
JavaScript Patterns (source recon)
// Look for in JS bundles
XMLSerializer
DOMParser
parseFromString
new ActiveXObject("Microsoft.XMLDOM")
$.parseXML(
xml2js
libxmljs
lxml
Tech Stack Signals
- Java stacks: Spring, Struts, JAX-WS — default XML parsers (SAX, DOM) are XXE-vulnerable without explicit hardening
- PHP:
simplexml_load_string(),DOMDocument::loadXML()— vulnerable by default pre-PHP 8 - Python:
lxml,xml.etree(safe by default),xml.sax(unsafe) - Ruby:
Nokogiriolder versions,REXML - Node.js:
xml2js,libxmljs,fast-xml-parser(older versions) - WSDL/SOAP services: Always test — legacy XML parsing virtually guaranteed
- File parsers: Apache POI (Java), python-docx, LibreOffice integrations
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 367 lines · 31 tokens per session scan E 53455e42e91d
hunt-xxe is a skill published in the GitHub repository adriannoes/awesome-agentic-ai (57 stars, last pushed 13d ago), licensed MIT. It adds 31 tokens to every session and 4,623 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
kotlin-ktor-patterns
Ktor server patterns including routing DSL, plugins, authentication, Koin DI, kotlinx.serialization, WebSockets, and testApplication testing.
goframe-v2
GoFrame development skill. TRIGGER when writing/modifying Go files, implementing services, creating APIs, or database operations. DO NOT TRIGGER for frontend/shell scripts.
java-coding-standards
Java coding standards for Spring Boot services: naming, immutability, Optional usage, streams, exceptions, generics, and project layout.
backend-builder
A backend implementation role for Codex Project Autopilot, a workflow that coordinates project work. It builds the server-side logic and connects it to integrations according to an approved plan.
api-design
Use this skill when designing, reviewing, or refactoring REST APIs in WrongStack. Triggers: user says "API", "endpoint", "REST", "request", "response", "JSON", "HTTP", "status code", "pagination", "query params", "request body".
reviewing-changes
Use when a review package asks you to review a plan step's change set (todo.startReview): you are the REVIEWER, not the author. How to judge an agent-written diff, file findings with addreviewcomment, and settle with exactly one reviewverdict.