Agent skill · security · secondsky
xss-prevention
XSS attack prevention with input sanitization, output encoding, Content Security Policy. Use for user-generated content, rich text editors, web application security, or encountering stored XSS, reflected XSS, DOM manipulation, script injection errors.
Why this skill is useful
Provides specific implementation patterns and code snippets for preventing XSS attacks that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-06. 204 stars on the source repository.
What this skill does
XSS Prevention Overview Implement comprehensive Cross-Site Scripting attack prevention through input sanitization, output encoding, Content Security Policy headers, and secure coding practices. When to Use User-generated content display Rich text editors Comment systems Search functionality Dynamic HTML generation Template rendering scenarios XSS Attack Types Type Vector Defense ------ -------- --------- Reflected URL parameters Output encoding Stored Database content Input sanitization DOM-based Client-side JS Safe DOM APIs Mutation HTML parser quirks Strict sanitization Output Encoding (Node.js) DOMPurify Sanitization Content Security Policy Safe DOM APIs ❌ NEVER do any of the following with user-controlled input — these are XSS sinks and there is no safe way to call them with untrusted data: Assign it to element.innerHTML / element.outerHTML Pass it to eval() Pass it to document.write() Pass it to setTimeout / setInterval as a string Insert it into an inline event handler (e.g. onclick="...") The safe patterns above (textContent, attribute escaping via setAttribute, DOMPurify.sanitize) are the only correct ways to handle user input in the DOM. URL Validation Context-Specific Encoding Different contexts require different encoding approaches: HTML Entity Encoding: Safest option for text content Attribute Encoding: For HTML attributes JavaScript Escaping: For script contexts URL Encoding: For URL parameters CSS Escaping: For stylesheet contexts Always encode output by the specific context where data will be rendered. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills secondsky/xss-prevention