hunt-dom

Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker abuse (intercept requests from same-origin script), CSS Injection/Exfiltration (attribute selectors → token char-by-char via OOB), client-side template injection, dangerouslySetInnerHTML. Grounded in named public research: Gareth Heyes / PortSwigger DOM-clobbering + DOM-Invader, Michał Bentkowski DOMPurify clobbering bypasses, jQuery htmlPrefilter XSS (CVE-2020-11022 / CVE-2020-11023), d0nut CSS-exfil research. Use when hunting DOM-XSS, client-side auth bypass, or token exfiltration without server-side interaction.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A richly actionable, validation-disciplined hunting playbook with executable commands and PoCs throughout. Its main weakness is structure: with no bundle files, everything is inlined into one long SKILL.md rather than split into well-signaled reference files.

Suggestions

Move the per-phase PoC snippets (e.g. the PostMessage listener/sender HTML and the Service Worker registration/evil-sw.js blocks) into reference files under references/ and link to them from each phase section to improve progressive disclosure.

Extract the Chain Table and severity rubric into a separate references/chain-matrix.md, keeping only a short summary in SKILL.md.

Trim the grounding prose in the description and the 'Crown Jewel Targets' narrative to the minimum needed for technique provenance, reducing verbosity without losing actionability.

Dimension	Reasoning	Score
Conciseness	The body is dense and mostly assumes competence without padding concepts Claude already knows, but a handful of parenthetical asides ("corrects a common mistake", "corrects an overstatement") and the lengthy grounding prose add modest verbosity that could be trimmed.	4 / 5
Actionability	Every phase ships copy-paste-ready executable artifacts: grep/curl recon one-liners, browser-console JS, HTML PoC iframes, CSS-exfil selectors, and a SW registration snippet, covering the common cases concretely.	5 / 5
Workflow Clarity	A clear phased 1-6 sequence is paired with explicit validation checkpoints: OOB-confirmation before reporting, reading the live CSP first, and proving Service Worker persistence by closing and reopening tabs.	5 / 5
Progressive Disclosure	There are no references/, scripts/, or assets/ bundle files, so the entire 279-line body is inlined; section headers give some structure, but per-phase PoC libraries and the chain table are candidates for one-level-deep reference files that are currently buried inline.	3 / 5
	Total	17 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A precise, well-scoped description that names concrete DOM attack classes and gives an explicit 'Use when' trigger. It is slightly over-loaded with CVE identifiers and researcher citations for a trigger description, which keeps trigger-term quality just below the top anchor.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete vulnerability classes with their mechanisms ("DOM Clobbering (overwrite JS globals via HTML injection)", "PostMessage hijacking (missing origin check)", "CSS Injection/Exfiltration (attribute selectors -> token char-by-char via OOB)"), giving comprehensive coverage of the skill's actions.	5 / 5
Completeness	Explicitly answers both what the skill does (enumerated DOM attack classes) and when to use it via the clause "Use when hunting DOM-XSS, client-side auth bypass, or token exfiltration without server-side interaction."	5 / 5
Trigger Term Quality	Includes natural user phrases like "hunting DOM-XSS", "client-side auth bypass", and "token exfiltration without server-side interaction", but the opening is dense with CVE numbers and researcher names rather than the plain synonyms a user would most naturally say.	4 / 5
Distinctiveness Conflict Risk	A clear client-side DOM-vulnerability niche grounded in named public research, with trigger phrases unlikely to fire for unrelated skills, giving minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-dom/SKILL.md
Commit: 646b72e

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.