Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-clnt-06
Testing for Client-Side Resource Manipulation
Passed 17 of 22 test cases with the skill, and 9 of 22 without it.
and 8 more in the full report
8 fixed9 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
When documenting security findings for dynamic script tag source parameter manipulation during web security assessments, what CVSS score and severity level should be assigned for external script loading?
| Checked | Without skill | With skill |
|---|---|---|
| Assigns a CVSS score of 8.6 for external script loading. | Missed | Passed |
| Assigns a severity rating of High for external script loading. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CLNT-06
Testing for Client-Side Resource Manipulation
Client-side resource manipulation occurs when attackers can control what resources (scripts, styles, images) a page loads. This can lead to loading malicious scripts, defacement, or data theft by manipulating URLs of external resources.
#!/bin/bash
TARGET="https://target.com"
# Check if script sources can be manipulated
curl -s "$TARGET/page?script=https://evil.com/malicious.js" | grep -i "script.*src"
curl -s "$TARGET/page?callback=alert" | grep -i "callback"
test cases passed, vs 9 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.