Something along these lines is done here: https://github.com/esl/ejabberd_tests/blob/stream-management/tests/vcard_update.erl (function server_string_type/0).

I'm not convinced, though, that skipping the test is a good idea. If the test fails, it's the best sign that something is clearly wrong and in this case it definitely is if the server is vulnerable to the bomb.