Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-clnt-02
Testing for JavaScript Execution
Passed 18 of 22 test cases with the skill, and 17 of 22 without it.
and 1 more in the full report
1 fixed17 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
Can you conduct an assessment on our web application's input fields for client-side script execution risks? I need a structured breakdown covering URI schema checks, event attribute handling, and dynamic code evaluation sinks, formatted as a summary report with risk severities and remediation advice.
| Checked | Without skill | With skill |
|---|---|---|
| Assigns CVSS 6.1 to javascript: URI findings. | Missed | Passed |
| Assigns CVSS 8.6 to user input dynamic code evaluation. | Missed | Passed |
| Includes template literal injection in the assessment scope. | Missed | Passed |
| References CWE-95 for dynamic code execution risks. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CLNT-02
Testing for JavaScript Execution
This test identifies scenarios where user input can lead to arbitrary JavaScript execution through various vectors including javascript: URIs, event handlers, and dynamic code evaluation.
# Test link href
curl -s "https://target.com/redirect?url=javascript:alert(1)"
# Test image src
curl -s "https://target.com/profile?avatar=javascript:alert(1)"
test cases passed, vs 17 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.