docem
CLI utility for embedding XXE (External XML Entity) and XSS (Cross-Site Scripting) payloads into document formats that use ZIP archives with internal XML files (DOCX, ODT, PPTX, XLSX). Designed for penetration testing and bug bounty hunting to test document processing systems.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Offensive security tool by design — generates XXE/XSS payloads for authorized testing. No license specified. Local-only execution. No network communication required for core functionality. Should only be used with proper authorization.
⚡ Reliability
Best When
Security researchers need to quickly generate document files with embedded XXE/XSS payloads to test how applications handle uploaded documents containing malicious XML content.
Avoid When
You need to test non-XML document formats, or you lack authorized access to the target system. This is a penetration testing tool that should only be used with proper authorization.
Use Cases
- • Creating test documents with XXE payloads for security testing of document upload functionality
- • Generating XSS-injected documents to test web applications that render uploaded document content
- • Batch-generating hundreds of payload-embedded documents with different injection modes
- • Bug bounty hunting against document processing and file upload endpoints
Not For
- • Malicious use against systems without authorization
- • MCP server integration — CLI tool only
- • Document creation or editing — injection tool only
- • Testing non-XML-based document formats (PDF, images, etc.)
Interface
Authentication
No authentication required. Runs as a local CLI tool.
Pricing
Open source. No license specified in repository.
Agent Metadata
Known Gotchas
- ⚠ Security/offensive tool — should only be used with explicit authorization
- ⚠ CLI tool — requires subprocess invocation, not an API or MCP server
- ⚠ Requires pre-created template documents with magic marker strings
- ⚠ Output goes to ./tmp/ directory — no configurable output path documented
- ⚠ No license specified — unclear redistribution rights
- ⚠ Last significant update may be dated — check maintenance status
Full Evaluation Report
Comprehensive deep-dive: security analysis, reliability audit, agent experience review, cost modeling, competitive positioning, and improvement roadmap for docem.
AI-powered analysis · PDF + markdown · Delivered within 30 minutes
Package Brief
Quick verdict, integration guide, cost projections, gotchas with workarounds, and alternatives comparison.
Delivered within 10 minutes
Score Monitoring
Get alerted when this package's AF, security, or reliability scores change significantly. Stay ahead of regressions.
Continuous monitoring
Scores are editorial opinions as of 2026-03-08.