Individual skill

web-xss

Find and prove Cross-Site Scripting (reflected, stored, DOM). Load when input is echoed into HTML/JS/attributes, a search/comment/profile field renders your text, a URL param appears in the response, or a sink like innerHTML/document.write is in client JS. Signals: "search=", reflected values, error pages echoing input, Angular/React dangerouslySetInnerHTML.

skills/web/web-xss/SKILL.md

Read pinned source

Source commit ee0e0c50d2f6d941a14b73dd85a2b470d0ab976e

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Not checked yet
Last checked: Nov 7, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 27
Repository last updated: Oct 14, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent-skills Repository topic
ai-agents Repository topic
ai-security Repository topic
application-security Repository topic
blue-team Repository topic
bug-bounty Repository topic
claude-code Repository topic
codex Repository topic
detection-engineering Repository topic
gemini Repository topic
engineering Derived category
security Derived category
security-application Derived category
engineering-web Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 2,894 bytes
detection.mddoc · 2,745 bytes

Read excerpt


# Cross-Site Scripting (XSS)

## When it applies
Any place your input reaches the response or the DOM without correct context-aware output
encoding: reflected (in the immediate response), stored (saved then rendered to others),
or DOM-based (client-side JS writes attacker data into a sink).

## Why it works
The browser can't tell your data from the page's own markup/script. If input lands in an
HTML context and the app doesn't encode `< > " ' &` *for that exact context*, your bytes
become new elements, attributes, or script. Filters usually fail because they encode for
the wrong context (HTML-encode but you're in a JS string, or in an attribute, or in a URL).

## Method