Individual skill

php-serialization-audit

PHP 源码序列化与模板类漏洞审计。当在 PHP 白盒审计中需要检测反序列化、XML 解析或模板注入漏洞时触发。 覆盖 3 类风险: PHP 反序列化(unserialize/phar 反序列化/POP 链构造)、 XXE(XML 外部实体注入/libxml 配置)、SSTI(模板注入/Twig/Blade/Smarty 引擎)。 需要 php-audit-pipeline 提供的数据流证据。

skills/code-audit/php/php-serialization-audit/SKILL.md

Source commit c0d3a4645f26be5b94f64344b501db4191dc9788

What was checked

Matches the observed repository HEAD

Yes

Scanner rules are current

No

Repository scan complete

No

Skill scan complete

Yes

Observed behavior

Not checked yet

Last checked

Nov 3, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.