dom-clobbering

DOM clobbering — abuse named HTML elements to overwrite JavaScript global variables, bypass CSP, hijack object property lookups.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/dom-clobbering/SKILL.md

Quality

Content

87%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is lean, actionable, and well-structured with executable payloads and detection code. The main gap is workflow clarity, where the PoC sequence lacks explicit validation/feedback checkpoints.

Suggestions

Turn the PoC section into an explicit numbered workflow with validation checkpoints, e.g. (1) find injection sink, (2) inject form clobber, (3) confirm window.config resolves to the element, (4) confirm exfil via interactsh, (5) if confirmation fails, try a multi-level clobber variant.

Add a short feedback loop note for failed clobbers (sanitizer stripped id/name → fall back to allowed attribute or alternate element).

Dimension	Reasoning	Score
Conciseness	Lean and code-heavy throughout; it assumes Claude's knowledge of HTML/JS and avoids explaining basics, with every section earning its place.	5 / 5
Actionability	Copy-paste-ready HTML payloads, an executable detection snippet, and specific sanitizer configs (FORBID_ATTR, Object.defineProperty) cover the common cases concretely.	5 / 5
Workflow Clarity	Sections 4-6 give a rough find-sink/inject/confirm sequence, but validation checkpoints are implicit and there is no explicit feedback loop (e.g. confirm clobber held, then escalate).	3 / 5
Progressive Disclosure	A compact, well-organized single-purpose skill under 50 lines with no bundle files and clear section headers; the simple-skill exception applies.	5 / 5
	Total	18 / 20 Passed

Description

62%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct but lacks an explicit 'Use when' trigger clause and leans on technical jargon over natural user phrases. Adding a trigger clause would lift completeness and trigger-term quality.

Suggestions

Append an explicit trigger clause, e.g. 'Use when auditing client-side HTML injection, sanitizer bypasses, or when the user mentions DOM clobbering, window globals, or named-element abuse.'

Add a few natural synonyms users might say (e.g. 'window globals', 'named element abuse', 'sanitizer bypass') alongside the technical terms.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions — 'overwrite JavaScript global variables', 'bypass CSP', 'hijack object property lookups' — but stops short of fully enumerating payload techniques, leaving minor coverage gaps.	4 / 5
Completeness	The 'what' is clearly stated (abuse named HTML elements to clobber globals/CSP/property lookups) but there is no explicit 'Use when...' trigger clause, which caps completeness at 3 per the rubric.	3 / 5
Trigger Term Quality	Relevant terms like 'DOM clobbering', 'named HTML elements', 'CSP', and 'global variables' are present, but the phrasing leans technical and omits casual synonyms a user might naturally say.	3 / 5
Distinctiveness Conflict Risk	'DOM clobbering' is a clear niche with distinct triggers and minimal overlap with adjacent XSS or CSS-injection skills.	5 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/dom-clobbering/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.