SKILL: XSLT Injection — Testing Playbook

> AI LOAD INSTRUCTION: XSLT injection occurs when attacker-influenced XSLT is compiled/executed server-side. Map the processor family first (Java/.NET/PHP/libxslt). Then chain document(), external entities, EXSLT, or embedded script/extension functions per platform. Authorized testing only; many payloads are destructive. Routing note: if input is generic XML parsing and may not flow through XSLT, cross-load xxe-xml-external-entity; if you care about outbound document(http:...) requests, cross-load ssrf-server-side-request-forgery.