# Deserialization Parser Review

> Reviews parsers, deserialization, uploads, archives, YAML/JSON/XML/pickle, paths, templates, SSRF, and unsafe loaders.

- Skill: `mesteriis/deserialization-parser-review` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add mesteriis/deserialization-parser-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mesteriis/deserialization-parser-review/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Mesteriis (https://skillmd.com/u/mesteriis)
- Updated: 2026-08-19
- Page: https://skillmd.com/skills/mesteriis/deserialization-parser-review

---


# Deserialization Parser Review

Review parser and loader attack surfaces.

## Workflow

1. Identify all attacker-controlled bytes, paths, URLs, archive entries, and
   structured documents.
2. Trace into parser, loader, resolver, filesystem, network, or command use.
3. Check safe loader modes, size limits, recursion/decompression limits, path
   normalization, symlink handling, and schema validation.
4. Validate exploitability or mark proof gaps.
5. Recommend a minimal defensive change.

## Output

- input source
- parser/loader sink
- control weakness
- exploit path
- mitigation
- validation plan

## Rule

Do not claim a parser bug from library reputation alone. Tie the concern to how
this repo uses the parser.