Xxe Phantom | Agent Skills Atlas

About this skill

Complete XXE (XML External Entity) detection and exploitation methodology — classic file read, blind OOB exfiltration, XInclude, SVG/DOCX/SAML vectors, WAF bypass, SSRF chaining, and report structure. Use when an endpoint accepts XML (Content-Type application/xml, or SVG/DOCX/SAML/SOAP input) and you want to read files, probe internal services, or chain to SSRF.

Quick start

Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.

Installation guide →

Review, license & listing details

Review the source before using this skill

This is an imported listing. We haven’t certified its safety, license, or compatibility. Skills may include executable scripts.

Automated security scan: Partial

Only SKILL.md was scanned. Supporting files and scripts were not checked. No safety grade has been assigned.

1 potential finding · Scanned 11/4/2026 · Scanner 0.2.1

critical: reverse shell — SKILL.md, line 671

Content SHA-256: f00f54c2ecff2035012ac4a9e44752095bd09827f38f583198794819852ad556

About scan coverage and limitations

Original listing metadata

Original name

xxe-phantom

Original description

About this listing

Category: Security
Reported license: MIT
Listing language (estimated): English
Review status: Not individually reviewed
Agent compatibility: Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.