How to use the XXE Injection Testing Checklist agent skill

What the offensive-xxe skill makes the agent do

An agent skill is a folder containing a SKILL.md file with instructions that the agent loads when a conversation matches the skill's topic. This one contains a methodology for XML External Entity (XXE) injection, a class of bug where a server's XML parser wrongly reads local files or fetches internal URLs.

The checklist covers classic XXE, blind XXE (out-of-band), error-based XXE, XInclude attacks, XXE via file upload (SVG and docx), XXE in SOAP and REST endpoints, and XXE filter bypass. The agent is told to follow the steps in order unless you say otherwise, consider each technique against your current target, track completed items and suggest next steps based on findings.

The skill is written for offensive security testing and bug bounty work. Its output is attack-oriented guidance, not a list of defensive fixes.

Install the skill in Claude

Download the ZIP file for the skill from this page. It contains the skill folder with SKILL.md inside. Unzip it, then place the folder in one of two locations: ~/.claude/skills/ to make the skill available across your projects, or .claude/skills/ inside a specific project folder to limit it to that project.

You can also add the skill in the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the skill there. Use whichever route fits how you work, and confirm the skill appears in your list before relying on it.

• Option A: unzip into ~/.claude/skills/ for personal use across projects
• Option B: unzip into .claude/skills/ inside one project
• Option C: upload through Settings → Capabilities → Skills in the Claude apps

Trigger the skill with natural requests

You do not need a special command. The skill activates when your conversation involves XXE-related terms. The trigger phrases in the skill include XXE, XML external entity, blind XXE, out-of-band XXE, XXE file upload, SVG XXE, SOAP XXE, XInclude, entity bypass, XXE SSRF and XXE file read.

Describe your situation in plain language and state that you are testing an authorised target. The more context you give about the endpoint and what it returns, the more useful the checklist will be.

• Walk me through an XXE checklist for this SOAP endpoint, which I am testing under an authorised pentest.
• Does this SVG upload feature look like a candidate for SVG XXE? Suggest what to check next.
• I am on a bug bounty program and the target accepts XML. Which blind XXE checks should I run first?
• Track which XXE checks we have completed and suggest the next step.

Work through a typical session

The checklist starts with finding data entry points that accept XML. It then asks whether an endpoint is a candidate for classic XXE, which applies when the parsed XML is returned in the HTTP response, or for blind XXE, which applies when it is not and needs a callback listener.

From there the agent suggests test payloads to see whether the parser processes external entities, and then describes further steps such as attempting a common low-impact file read, trying alternative exfiltration methods if a full read fails, and checking whether XXE can be used for SSRF. Keep your own notes on what each step returned so the agent can track progress accurately.

• Identify XML input points: API endpoints, file uploads, SOAP services and content-type conversion.
• Test whether the parser handles external entities, classic or blind.
• Try alternative exfiltration methods if a simple payload is not enough.
• Check for SSRF using XXE and review the next steps the agent suggests.

Safety, scope and what the skill needs

The skill's payloads target file reads, SSRF and denial of service. Denial-of-service payloads and file-disclosure payloads can cause real harm or outages, and running them against systems you do not own or have written permission to test may break the law. Use it only on authorised pentests, in-scope bug bounty targets, or your own lab.

Per the listing, the skill requires nothing beyond the skill itself, does not run scripts and does not use the network. The network-related work happens when you run the tests yourself against a target, so the scope decision is yours. It is also not a parser hardening guide; if you want configuration fixes, use a defensive resource.

• Requires: nothing listed
• Runs scripts: no
• Uses network: no
• Only test systems you own or have written permission to test