Agent skill · security · yaklang
xss-cross-site-scripting
XSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.
Why this skill is useful
Adds advanced XSS attack techniques and context-specific payloads that the AI wouldn't reliably generate on its own.
What it needs
About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Cross-Site Scripting (XSS) — Expert Attack Playbook AI LOAD INSTRUCTION: This skill covers non-obvious XSS techniques, context-specific payload selection, WAF bypass, CSP bypass, and post-exploitation. Assume the reader already knows <script>alert(1)</script> — this file only covers what base models typically miss. For real-world CVE cases, HttpOnly bypass strategies, XS-Leaks side channels, and session fixation attacks, load the companion SCENARIOS.md. 0. RELATED ROUTING Extended Scenarios Also load SCENARIOS.md when you need: Django debug page XSS (CVE-2017-12794) — duplicate key error → unescaped exception → XSS UTF-7 XSS for legacy IE environments (+ADw-script+AD4-) HttpOnly bypass methodology — proxy-the-browser, session riding, CSRF-via-XSS XS-Leaks side channel attacks — timing oracle, cache probing, performance.now() measurement Session fixation via XSS — pre-set session ID before victim login DOM clobbering techniques for CSP-restricted environments Advanced Tricks Also load ADVANCEDXSSTRICKS.md when you need: mXSS / DOMPurify bypass — namespace confusion, <noscript> parsing differential, form/table restructuring DOM Clobbering — property override via id/name, HTMLCollection, deep property chains Modern framework XSS — React dangerouslySetInnerHTML, Vue v-html, Angular bypassSecurityTrust, Next.js SSR Trusted Types bypass — default policy abuse, non-TT sinks, policy passthrough Service Worker XSS persistence — malicious SW registration, fetch interception, post-patch survival PDF/SVG/MathML XSS vectors, polyglot payloads, browser-specific tricks XS-Leaks & side channels — timing oracle, frame counting, cache probing, error event oracle Before broad payload spraying, you can first load: upload insecure files when you need the full upload path: validation, storage, preview, and sharing behavior Quick context picks Context First Pick Backup --- --- --- HTML body <svg onload=alert(1)> <img src=1 onerror=alert(1)> Quoted attribute " autofocus onfocus=aler …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/xss-cross-site-scripting