Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-clnt-11
Testing Web Messaging
Passed 18 of 22 test cases with the skill, and 18 of 22 without it.
2 fixed16 passed either way2 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
Under the OWASP Web Security Testing Guide client-side framework, what official Test ID covers Testing Web Messaging?
| Checked | Without skill | With skill |
|---|---|---|
| The response identifies WSTG-CLNT-11 as the OWASP Test ID. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CLNT-11
Testing Web Messaging
HTML5 Web Messaging (postMessage API) allows cross-origin communication between windows/frames. Vulnerabilities arise when messages are sent without proper origin validation or when received messages are processed without sanitization, leading to XSS or data leakage.
// Browser console - Find postMessage listeners
// Check for message event listeners
const listeners = getEventListeners(window)
console.log("Message listeners:", listeners.message)
// Monitor postMessage calls
const originalPostMessage = window.postMessage
window.postMessage = function (message, targetOrigin, transfer) {
console.log("postMessage called:")
test cases passed, vs 18 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.