Agent skill · security · aradotso
acidrain-xss-security-testing
AcidRain web security toolbox for XSS analysis, JavaScript utilities, and PHP injection testing in authorized environments
Why this skill is useful
Provides specific JavaScript and PHP scripts for XSS testing and analysis that are not commonly found in public documentation.
What it needs
Requires git installed locally. About 6k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
AcidRain XSS Security Testing Skill Skill by ara.so — Security Skills collection. Overview AcidRain is a web-oriented collection of XSS analysis resources, JavaScript utilities, PHP examples, and injection testing samples for authorized security testing and hands-on learning. It provides browser-side and server-side material organized for web security research, penetration testing education, and controlled vulnerability analysis. Key capabilities: XSS payload generation and testing JavaScript-based client-side security utilities PHP server-side injection examples Input validation and output encoding analysis Web security research snippets License: GPL-3.0 Primary Languages: HTML, JavaScript, PHP Installation Clone the repository and navigate to the project directory: Explore the directory structure: Project Structure JavaScript Utilities Basic XSS Payload Injection Example JavaScript for testing XSS vulnerabilities in authorized environments: DOM-Based XSS Analysis Cookie Extraction Utility PHP Server-Side Examples Input Validation Testing SQL Injection Testing Helper XSS Payload Reference Common XSS Vectors Configuration Create a configuration file for your testing environment: Environment Variables Common Patterns Setting Up a Test Target Running JavaScript Tests in Browser Automated Testing Workflow Troubleshooting Issue: Scripts Not Executing Solution: Check authorization environment variable: Issue: PHP Connection Errors Solution: Verify database credentials and connectivity: Issue: CORS Errors in Browser Solution: Configure test server with proper headers: Issue: Payloads Not Triggering Solution: Check encoding and context: Best Practices 1. Always obtain authorization before testing any system 2. Use isolated environments (VMs, containers, local servers) 3. Document all tests with timestamps and results 4. Never test production systems without explicit permission 5. Store credentials in environment variables, never in code 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/acidrain-xss-security-testing