Home / Skills / deserialization-xxe

deserialization-xxe

zhaji2333/CkSKILLSSkill

当发现XML导入/SOAP/Office解析、序列化数据（Java/PHP/Python/.NET）、JSON深合并、yaml.load、不可信反序列化入口时调用。负责反序列化RCE链、XXE、原型污染、phpggc/ysoserial利用链构造与验证。

ScannedSkillSource: GitHub
122 stars +6 this week Updated 2mo ago License MIT Context ≈37 tokens always loaded
55popular

Why this score

Stars8/35
Usage (forks)2/15
Upkeep20/25
License15/15
Owner history10/10

This repo hosts 10 skills, so its 122 stars are split between them (about 12 each) for scoring.

Popularity score: 55/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

Security

Scanned Oct 20, 2026 at commit 482fe78a83ca, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Nothing from another maker does quite the same job yet.