expression-language-injection — Skills

What it does

ssti-server-side-template-injection for template engines (Jinja2, FreeMarker, Twig) — different attack surface

jndi-injection when EL evaluation leads to JNDI lookup

@Value("${...}") annotations

Spring Security expressions (@PreAuthorize)

Spring Cloud Gateway route predicates and filters

Thymeleaf th:text="${...}" (when combined with ${...} preprocessing)

Spring Data @Query with SpEL

expression language injection

Source

Repository: https://github.com/yaklang/hack-skills

expression-language-injection FAQ

What does the expression-language-injection skill do?

>- Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence, or similar frameworks. ssti-server-side-template-injection for template engines (Jinja2, FreeMarker, Twig) — different attack surface jndi-injection when EL evaluation leads to JNDI lookup

How do I install expression-language-injection?

Run: npx -y skills add https://github.com/yaklang/hack-skills --skill expression-language-injection --agent claude-code — the source lives at github.com/yaklang/hack-skills.

Maintain expression-language-injection?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[expression-language-injection on getagentictools](https://getagentictools.com/skills/yaklang-hack-skills-expression-language-injection?ref=badge)

npx agentictools info skills/yaklang-hack-skills-expression-language-injection

The second line is the CLI lookup for this page — handy in READMEs and docs.