Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-clnt-13
Testing for Cross-Site Script Inclusion (XSSI)
Passed 21 of 22 test cases with the skill, and 20 of 22 without it.
1 fixed20 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
An assessment reveals an endpoint delivering dynamic JavaScript containing user-specific authentication tokens when loaded with credentials. According to OWASP WSTG scoring guidelines, what severity level and CVSS score apply to authenticated JavaScript hijacking?
| Checked | Without skill | With skill |
|---|---|---|
| Rates authenticated JavaScript hijacking as High severity | Passed | Passed |
| Assigns a CVSS score of 7.5 | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CLNT-13
Testing for Cross-Site Script Inclusion (XSSI)
Cross-Site Script Inclusion (XSSI) allows attackers to steal sensitive data by including a victim's JavaScript files as script sources from an attacker-controlled page. This exploits the fact that JavaScript files may contain sensitive user data and are not protected by Same-Origin Policy when loaded as scripts.
#!/bin/bash
TARGET="https://target.com"
# Find JavaScript endpoints
echo "[*] Finding JavaScript files..."
# Check for dynamic JS endpoints
curl -s "$TARGET" | grep -oP 'src="[^"]*\.js[^"]*"' | sort -u
test cases passed, vs 20 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.