Individual skill

hunt-xss

Hunting skill for Cross-Site Scripting (XSS) — DOM-based, stored, reflected, mutation-based (mXSS), and modern variants. Built from public bug bounty reports across HackerOne, Intigriti, Bugcrowd, Huntr, and GitHub Security Advisories, plus 2024-2026 meta verified against NVD — DOMPurify nesting mXSS (CVE-2024-47875, GHSA-gx9m-whjm-85jf), DOMPurify depth-bypass family (CVE-2024-45801, GHSA-mmhx-hmjr-r674), DOMPurify mXSS via Re-Contextualization (GHSA-h8r8-wccr-v5f2), Auth0 nextjs-auth0 returnTo (CVE-2025-67716, GHSA-mr6f-h57v-rpj5), React Server Components DoS family (CVE-2025-67779/55184, GHSA-5j59-xgg2-r9c4), markdown-to-jsx iframe XSS (CVE-2024-21535), listmonk stored XSS → Admin ATO (GHSA-jmr4-p576-v565, CVSS 8.0). Use when hunting DOM XSS, stored XSS, reflected XSS, postMessage XSS, mXSS, sanitizer bypass (DOMPurify / sanitize-html / bleach), OAuth redirect_uri XSS, prototype pollution → XSS gadgets, markdown renderer XSS, Server Components content injection, agentic LLM output injection.

providers/cursor/.cursor/skills/pentest-agents-hunt-xss/SKILL.md

Source commit 41d49b644e1bc0f3031819410fc5406918360c4e

What was checked

Matches the observed repository HEAD

Yes

Scanner rules are current

No

Repository scan complete

No

Skill scan complete

No

Observed behavior

Not checked yet

Last checked

Nov 4, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.