{"slug":"utkusen-sast-xss","source_name":"utkusen/sast-xss","name":"Utkusen/Sast XSS","description":"Detect Cross-Site Scripting (XSS) vulnerabilities in a codebase using a three-phase approach: recon (find HTML/JS/DOM sink sites), batched verify (trace user input to sinks in parallel subagents, 3 sink sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/xss-results.md. Use when asked to find XSS or cross-site scripting bugs.","version":1,"lift":{"pass_rate_delta_pts":12,"pass_rate_pct":72,"total_cases":25,"passed_cases":18,"tokens_delta_pct":387,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-08-14T01:19:35.977766+00:00"},"skill_score":0.72,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":12,"with_pass_pct":72,"without_pass_pct":60,"tokens_delta_pct":387,"turns_delta_pct":0,"total_cases":25,"cases_aggregated":24,"verdict":"mixed","never_hurt":false,"completed_at":"2026-08-14T01:19:35.977766+00:00","run_id":"aff8f128-7c6f-4360-a895-87b871d93fcc","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":"MIT","install_count":0,"manifest_hash":"6a2201fb5624011e5576c2bd44ce5ebe7d83fe8840259d545d625659546ef768","raw_url":"https://app.decimal.ai/s/utkusen-sast-xss/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/utkusen-sast-xss"}