hunting-xpath-and-xml-query-injection SKILL.md skillA
hunting-xpath-and-xml-query-injection from unboundcompute/security-agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add unboundcompute/security-agent-skills/hunting-xpath-and-xml-query-injection@git:20260903.6dac719Pins git:20260903.6dac719 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- unboundcompute/security-agent-skills
- Path
skills/hunting-xpath-and-xml-query-injection/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260903.6dac719, committed Sep 3, 2026
- Size
- 9,522 bytes
- Repository stars
- 26
- License
- MIT
Hunt XPath and XQuery injection where untrusted input is concatenated into a query expression that is then evaluated against an XML document or an XML database, so the input changes the structure of the query rather than supplying a value. A predicate closed early and rewritten to always be true bypasses an authentication or authorization lookup, and a rewritten path or an injected union walks the document to read nodes the caller was never meant to reach, including blind boolean and…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Hunting XPath and XQuery injection: when input rewrites the query XPath and XQuery are to XML what SQL is to a relational database, and they carry the same injection flaw. When an application builds a query by pasting untrusted input into the expression string, an attacker who supplies query syntax instead of a plain value changes what the query means. A login check that looks up a user node by matching a name and password predicate can be turned into a predicate that is always true, logging in as the first user with no credential. A lookup scoped to one node can be widened to walk the entire document and return records the caller should never see. Because XML documents have no table grants, the whole document is usually reachable once the expression is under attacker control. You find these by locating every expression built from request data and asking whether the input is bound as a parameter or concatenated as syntax. ## When to use - Code builds an XPath or XQuery expression by concatenating or interpolating request-derived strings. - Authentication, authorization, or lookup logic evaluates such an expression against an XML document. …
Read the whole file at its exact version.
How to install
mdr add unboundcompute/security-agent-skills/hunting-xpath-and-xml-query-injection@sha256:d9630c25108469cfThe line at the top of this page pins the label git:20260903.6dac719, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_ty4zgum5xc2trife)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 3, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (9522 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
unboundcompute/security-agent-skills · 26 stars · license MIT · pushed 2026-09-08 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_ty4zgum5xc2trife GET https://markdownregistry.com/api/v1/resolve?ref=unboundcompute/security-agent-skills/hunting-xpath-and-xml-query-injection GET https://markdownregistry.com/api/v1/blob/d9630c25108469cf19557bbf4afc59b53706b3392f608f9f7ce9d056ab37bd23
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.