What does this skill look for in PHP files?

It searches for patterns where variables, especially user-controlled data, are output to the browser without proper escaping or encoding, which could lead to Cross-Site Scripting (XSS).

Is this useful for pure JSON APIs?

Yes, it checks for proper Content-Type headers and JSON encoding flags to ensure API responses aren't misinterpreted as HTML by browsers.

How are vulnerabilities categorized?

Issues are rated by severity (Critical, Major, Minor) based on the context. For example, direct user input echoes and JavaScript context injections are marked as Critical.

Does it support template engines like Blade and Twig?

Yes, it specifically detects 'raw' output filters like {!! !!} in Blade and |raw in Twig that bypass the default auto-escaping mechanisms.

Can it suggest fixes for found vulnerabilities?

Yes, the skill provides specific fix examples showing how to apply the correct encoding functions, such as htmlspecialchars for HTML or json_encode with proper flags for JavaScript.

PHP Output Encoding Security Check

Name: PHP Output Encoding Security Check
Author: dykyi-roman

bydykyi-roman

•

セキュリティとテスト

Identifies cross-site scripting (XSS) vulnerabilities and improper output encoding in PHP applications.

This skill empowers Claude to perform automated security audits on PHP codebases by detecting dangerous output patterns that lead to XSS vulnerabilities. It scans for direct echoes of user input, raw template tags in Blade or Twig, unescaped JavaScript contexts, and insecure header injections. By providing specific severity classifications and structured remediation steps, it helps developers secure their web applications against common injection attacks while ensuring compliance with modern security best practices for output encoding.

主な機能

01Analyzes JavaScript, CSS, and URL contexts for injection risks

02Flags potential CRLF and header injection vulnerabilities

03Detects direct echo of raw user input and global variables

04Provides severity-rated findings with specific code fixes

05Identifies insecure Blade and Twig raw output filters

0645 GitHub stars

ユースケース

01Performing a pre-deployment security audit on a PHP web application

02Scanning legacy PHP templates for missing HTML entity encoding

03Ensuring third-party user content is safely handled in JavaScript contexts

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add dykyi-roman/awesome-claude-code check-output-encoding

For use in Claude.ai and ChatGPT

Download Skill