Agent skill · security · aradotso
acidrain-security-testing
Use AcidRain's XSS analysis resources, JavaScript utilities, and PHP injection testing samples for authorized security research and hands-on learning
Why this skill is useful
Adds multiple executable security testing scripts for XSS and injection vulnerabilities that aren't widely available in public resources.
What it needs
Requires git installed locally. About 6k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
AcidRain Security Testing Skill Skill by ara.so — Security Skills collection. AcidRain is a 2026 web-oriented collection of XSS analysis resources, JavaScript utilities, PHP examples, injection testing samples, and research snippets designed for authorized security testing and hands-on learning in controlled environments. Installation Clone the repository and navigate to the project directory: Expected directory structure: Project Structure and Components JavaScript Utilities (Client-Side) JavaScript utilities are located in scripts/javascript/. These are browser-based security testing scripts. Basic XSS Test Script: Cookie Extraction Utility: DOM-Based XSS Scanner: PHP Server-Side Examples PHP scripts are located in scripts/php/. Use these in authorized testing environments with PHP installed. Basic Injection Test: XSS Reflection Test: File Upload Validator: XSS Payload Examples Common XSS payloads for testing (use in scripts/xss/): Configuration Create a configuration file for test environments: PHP configuration: Common Testing Patterns Pattern 1: Automated XSS Parameter Testing Pattern 2: PHP Request Logger Pattern 3: Header Injection Test Troubleshooting Issue: Scripts Not Executing in Browser Solution: Check browser console for Content Security Policy (CSP) violations: Issue: PHP Scripts Returning Blank Page Solution: Enable error reporting in your test environment: Issue: Payloads Being Filtered Solution: Test with encoding variations: Issue: Rate Limiting or Blocking Solution: Implement request throttling: Best Practices 1. Always obtain authorization before testing any system 2. Use isolated environments for dangerous payload testing 3. Log all testing activity with timestamps and targets 4. Never test production systems without explicit permission 5. Validate inputs even in testing tools to prevent self-XSS 6. Keep payloads in configuration files referenced via environment variables 7. Document all findings with reproducible steps Environment Variables
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/acidrain-security-testing