CtrlK
BlogDocsLog inGet started
Tessl Logo

xss

Cross-Site Scripting (XSS) — reflected, stored, DOM-based XSS exploitation. Covers filter bypass, CSP evasion, bot-triggered cookie exfiltration, admin page scraping, and headless browser flag extraction. Use for any challenge involving client-side JavaScript injection, Cross payloads, cookie theft, or browser-based exploitation.

71

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable commands throughout and a reasonably clear multi-pattern workflow including budget-convergence safeguards. Its weaknesses are verbosity from overlapping payload/bypass catalogs and the absence of any bundle-file progressive disclosure despite a length that would benefit from splitting reference material out.

Suggestions

Consolidate the three overlapping filter-bypass sections ('Filter Bypass Techniques', 'Filter Bypass Cookbook', 'Bypass-Class Rotation Rule') into a single table to remove redundancy and cut tokens.

Move the bypass-class rotation table and JSFuck details into a references/ file (e.g. references/filter-bypass.md) and link from SKILL.md to improve progressive_disclosure.

Add an explicit validate→fix→retry loop for payload iteration (e.g., 'if grep finds no success indicator, rotate class and retry; after N failures write CONVERGED.md') to lift workflow_clarity to the top anchor.

DimensionReasoningScore

Conciseness

The body is mostly efficient and assumes Claude's competence, but it is long (~300 lines) with repeated payload catalogs, redundant filter-bypass sections (techniques list, cookbook table, class-rotation table overlap heavily), and restated anti-patterns, placing it at the 'mostly efficient but could be tightened' anchor rather than lean.

3 / 5

Actionability

Nearly every section provides copy-paste-ready, executable curl/node commands with concrete payloads and grep checks for success indicators, fully matching the score-5 anchor for fully executable guidance covering common cases.

5 / 5

Workflow Clarity

It provides an explicit pattern-selection quick-check, a numbered 8-step CTF workflow, and convergence/budget-cap rules with validation-like checkpoints (grep success indicators, CONVERGED.md fallback); however there is no explicit validate→fix→retry loop for the destructive/batch payload iteration, and the workflow branches across Pattern A/B without a single decisive checklist, so it sits just below the score-5 anchor.

4 / 5

Progressive Disclosure

The body is a single monolithic SKILL.md with no bundle files (references/, scripts/, assets/ all absent) and no one-level-deep file pointers; it relies on section headers for organization but inlines large cookbook/rotation tables that could live in separate reference files, matching the 'some structure but could be better organized' anchor.

3 / 5

Total

15

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong across all dimensions: it is specific, trigger-rich, fully answers what and when, and occupies a clear niche. It is written in third person and avoids vague fluff. The only minor caveat is that the description field embeds a long keyword list that borders on keyword stuffing, but this does not reduce any anchor below the top level.

DimensionReasoningScore

Specificity

The description lists multiple concrete, specific actions — 'reflected, stored, DOM-based XSS exploitation', 'filter bypass', 'CSP evasion', 'bot-triggered cookie exfiltration', 'admin page scraping', and 'headless browser flag extraction' — giving comprehensive coverage of the skill's capabilities, matching the score-5 anchor.

5 / 5

Completeness

It explicitly states both what the skill does (XSS exploitation covering the listed subtypes and techniques) and when to use it ('Use for any challenge involving client-side JavaScript injection, Cross payloads, cookie theft, or browser-based exploitation'), satisfying the score-5 anchor that requires concrete trigger phrases for both what and when.

5 / 5

Trigger Term Quality

It includes a rich set of natural user-facing terms and synonyms via the 'Use for...' clause — 'Cross payloads', 'cookie theft', 'browser-based exploitation', 'JavaScript injection' — and the metadata.when_to_use field adds many more natural phrases ('xss', 'cross-site scripting', 'cookie steal', 'alert', 'onerror', 'onload'), matching the comprehensive-coverage anchor.

5 / 5

Distinctiveness Conflict Risk

The XSS niche is sharply defined with distinct, specific triggers (Cross payloads, cookie exfiltration, headless browser flag extraction) that are unlikely to fire for unrelated skills, indicating minimal conflict risk per the score-5 anchor.

5 / 5

Total

20

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

relative_links

Relative link issues: 3 missing

Warning

Total

14

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.