What is an XXE vulnerability?

XML External Entity (XXE) is a vulnerability where an application parses XML input containing a reference to an external entity, potentially leading to private file disclosure, SSRF, or denial of service.

Does this skill work with PHP 8.0+?

Yes, it identifies both legacy vulnerabilities (where entities were enabled by default) and modern misconfigurations that explicitly re-enable risky settings like LIBXML_NOENT.

Can it detect XXE in SVG files?

Yes, it includes specific detection patterns to identify insecure SVG parsing, as SVGs are XML-based and frequently exploited via XXE.

How does it help with remediation?

For every vulnerability found, the skill provides a standardized 'Fix' section showing exactly how to apply secure flags like LIBXML_NONET or reject DOCTYPE declarations.

PHP XXE Security Scanner

Name: PHP XXE Security Scanner
Author: dykyi-roman

bydykyi-roman

•

Security & Testing

Identifies and remediates XML External Entity (XXE) vulnerabilities in PHP applications to prevent unauthorized data disclosure and SSRF.

This skill empowers Claude to perform deep security audits of PHP codebases, specifically targeting XXE vulnerabilities as defined in OWASP A03:2021. It scans for insecure configurations in SimpleXML, DOMDocument, and XMLReader, identifies risky XSLT and SOAP implementations, and detects unsafe SVG handling. By providing both detection patterns and secure remediation strategies, it helps developers harden their XML processing logic and prevent sensitive file disclosure or Server-Side Request Forgery (SSRF) attacks.

Key Features

0145 GitHub stars

02Identifies missing entity loader protections in legacy and modern PHP versions

03Detects risky XSLT processor settings and unsafe PHP function registration

04Provides standardized severity reporting and actionable secure code fixes

05Scans PHP code for insecure SimpleXML and DOMDocument configurations

06Flags vulnerable SOAP, XML-RPC, and RSS feed parsing implementations

Use Cases

01Remediating legacy PHP codebases that lack modern XML security defaults

02Automated security auditing during code reviews or CI/CD pipelines

03Hardening file upload systems that process XML-based formats like SVG

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add dykyi-roman/awesome-claude-code check-xxe

For use in Claude.ai and ChatGPT

Download Skill