Individual skill

java-serialization-audit

Java 源码序列化类漏洞审计。当在 Java 白盒审计中需要检测序列化/反序列化相关漏洞时触发。 覆盖 3 类风险: Java 原生反序列化(ObjectInputStream/Gadget Chain/ysoserial)、 XXE(DocumentBuilderFactory/SAXParser/XMLInputFactory/TransformerFactory/SchemaFactory 五种解析器)、 模板注入 SSTI(Velocity/FreeMarker/Thymeleaf 模板引擎代码执行)。 Java 反序列化是 Java 生态最具特色的高危漏洞类型，Gadget Chain 分析是核心难点。

skills/code-audit/java/java-serialization-audit/SKILL.md

Source commit c0d3a4645f26be5b94f64344b501db4191dc9788

What was checked

Matches the observed repository HEAD

Yes

Scanner rules are current

Yes

Repository scan complete

No

Skill scan complete

No

Observed behavior

Network or broad shell

Last checked

Nov 3, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.