sk Skill · ShieldNet-360
template-injection
User input reaching a template compiler rather than its context: the source-versus-values distinction, double-render pipelines, template names chosen by the caller, why a template sandbox is a mitigation and not a boundary, minimizing what the render context exposes, and template-driven resource exhaustion. Use when rendering templates with user-influenced values, when a template string or template name is assembled…
Open on skills.sh ↗read 2026-09-15
- installs 8w
- 0
- 30-day movement
- starts with the next reading
- Related entries
- 1
- Connections
- 0
Goprevention
- Host repository
- ShieldNet-360/secure-vibe
- Category
- prevention
- Version
- 2.0.0
- Compatible with
- when rendering a template with any user-influenced value (email or notification bodies, PDFs, HTML, config), when a template's source string, or the template's name or path, comes from input, when a product feature lets users author or edit templates, when reviewing a two-step render or re-parse pipeline
- Host stars
- 22
- Host language
- Go