{"slug":"elementalsouls-hunt-dom","source_name":"elementalsouls/hunt-dom","name":"Elementalsouls/Hunt DOM","description":"Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker abuse (intercept requests from same-origin script), CSS Injection/Exfiltration (attribute selectors → token char-by-char via OOB), client-side template injection, dangerouslySetInnerHTML. Grounded in named public research: Gareth Heyes / PortSwigger DOM-clobbering + DOM-Invader, Michał Bentkowski DOMPurify clobbering bypasses, jQuery htmlPr","version":1,"lift":{"pass_rate_delta_pts":4.55,"pass_rate_pct":90.9,"total_cases":22,"passed_cases":20,"tokens_delta_pct":182.9,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-08-09T13:21:43.943439+00:00"},"skill_score":0.9091,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":4.55,"with_pass_pct":90.9,"without_pass_pct":86.4,"tokens_delta_pct":182.9,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":22,"verdict":"mixed","never_hurt":true,"completed_at":"2026-08-09T13:21:43.943439+00:00","run_id":"17ee23f4-e79f-4e6a-8419-9c42c6902a6b","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":"NOASSERTION","install_count":0,"manifest_hash":"8d412498b0bd7cfc022dfefcdc426cb0062c6acf2ac525b23ad877eaa4da53cd","raw_url":"https://app.decimal.ai/s/elementalsouls-hunt-dom/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/elementalsouls-hunt-dom"}