Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-clnt-01.1
Testing for Self DOM-Based XSS
Passed 19 of 23 test cases with the skill, and 9 of 23 without it.
and 13 more in the full report
11 fixed9 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
In the self-XSS console warning remediation, what CSS font size is assigned to the scam warning message ('If someone told you to paste something here...')?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies a font size of 16px for the third warning line. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CLNT-01.1
Testing for Self DOM-Based XSS
Self DOM-Based XSS (also called Self-XSS) occurs when users are tricked into executing malicious JavaScript in their own browser context. While the attack requires social engineering, it can still lead to session theft or account compromise if combined with other vulnerabilities.
// Open browser console on target site
// Check if there's a warning message about pasting code
// Sites like Facebook show:
// "Stop! This is a browser feature intended for developers..."
// Check if console commands are restricted
console.log("test")
eval("alert(1)")
test cases passed, vs 9 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.