Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-clnt-01
Testing for DOM-Based Cross Site Scripting
Passed 11 of 22 test cases with the skill, and 11 of 22 without it.
1 fixed19 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
If a client-side DOM XSS flaw leads directly to session token extraction, what CVSS base score is assigned to this high severity finding?
| Checked | Without skill | With skill |
|---|---|---|
| The response specifies a CVSS score of 8.1. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CLNT-01
Testing for DOM-Based Cross Site Scripting
DOM-based XSS occurs when client-side JavaScript processes data from untrusted sources and writes it to the DOM without proper sanitization. Unlike reflected or stored XSS, the payload never reaches the server - the entire attack happens in the browser. This makes DOM XSS harder to detect with server-side security tools.
test cases passed, vs 11 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.