Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →elementalsouls/hunt-xss
Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports.
Passed 21 of 22 test cases with the skill, and 19 of 22 without it.
and 2 more in the full report
2 fixed19 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are conducting a web application security audit and need a clear triage protocol to evaluate observed parameter reflections and potential script injections. Please output a summary document formatted into three sections: initial reflection validation guidelines, out-of-band execution verification rules for asynchronous or stored cases, and an impact chain analysis template. The output should explain how to distinguish genuine vulnerabilities from benign encoded output.
| Checked | Without skill | With skill |
|---|---|---|
| Requires using a unique 4+ digit numeric canary inside proof payloads instead of alert(1) | Missed | Passed |
| Mandates verifying baseline responses before testing to ensure marker strings do not already exist on the page | Missed | Passed |
| Specifies testing reflection contexts in the strict order of inline script, attribute event injection, and URL/href context | Missed | Passed |
The instructions your model reads when the skill loads.
Verify reflection before claiming XSS — encoding is everything.
Your payload must appear in the response body with angle brackets UNESCAPED. <script> is XSS. <script> is safe encoding — not vulnerable.
Use a UNIQUE NUMERIC CANARY in your proof payload — e.g. <script>alert(91234)</script> or "><img src=x onerror=alert(91234)>. Pick a distinctive 4+ digit number, not alert(1). Practice pages are full of example payloads like alert(1)/alert('XSS') in their hint text; a unique number is how you tell YOUR reflected payload apart from the page's decoy examples. Proof = your alert(<canary>) shows up in the response with raw, unescaped angle brackets.
Try these contexts in order:
Inline script injection (works when HTML context allows new tags):
<script>alert(CANARY)</script>
Use whatever canary string your proof contract specifies. Confirmed when <script>alert(CANARY) appears literally (not HTML-encoded) in the response.
Attribute event injection (when < is filtered but attributes are injectable):
" onmouseover="alert(CANARY)
" onerror="alert(CANARY)
" onload="alert(CANARY)
URL/href context:
javascript:alert(CANARY)
Distinguishing success from failure:
<script>alert( unescaped — browser would execute it<script> or <script> — properly encodedFor stored XSS: inject into a field that other pages display (comments, usernames, ticket titles). Then fetch the rendering page and check for unescaped payload. The payload executes when any user views that page — higher severity than reflected.
XSS is high-value when it combines privileged context + persistent delivery + scope escalation. The highest payouts come from:
test cases passed, vs 19 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.