hunt-dom

Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker abuse (intercept requests from same-origin script), CSS Injection/Exfiltration (attribute selectors → token char-by-char via OOB), client-side template injection, dangerouslySetInnerHTML. Grounded in named public research: Gareth Heyes / PortSwigger DOM-clobbering + DOM-Invader, Michał Bentkowski DOMPurify clobbering bypasses, jQuery htmlPrefilter XSS (CVE-2020-11022 / CVE-2020-11023), d0nut CSS-exfil research. Use when hunting DOM-XSS, client-side auth bypass, or token exfiltration without server-side interaction.

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tightly written, highly actionable DOM-vulnerability hunting playbook with strong validation discipline and clear sequencing across six phases, scoring top marks on conciseness, actionability, and workflow clarity. Its only real weakness is progressive disclosure: all reference-grade material lives inline in one large file with no bundle files or one-level-deep references to offload the per-technique detail.

Suggestions

Move the per-phase PoC payloads (HTML/JS/SW/CSS generators) into per-technique reference files under references/ (e.g. references/postmessage-pocs.md, references/css-exfil.md) and keep SKILL.md as a concise overview with one-level-deep links, to improve progressive_disclosure.

Isolate version/time-sensitive facts (CVE-2020-11022/11023, jQuery < 3.5.0, DOMPurify bypass versions) into a single 'Known vulnerable versions' or 'Deprecated patterns' section rather than embedding them inline, per the conciseness guideline on time-sensitive information.

De-duplicate the false-positive guidance so each technique's validation rule appears once (either inline as a per-phase callout or centralized in the Validation section, not both) to tighten conciseness.

Dimension	Reasoning	Score
Conciseness	The body is dense and expert-facing — it assumes Claude's competence with no "what is a DOM" preamble and uses terse comments plus one-purpose code blocks — clearing the score-3 "lean and efficient; every token earns its place" bar, though minor restatement of false-positive guards across inline callouts and the Validation section, plus embedded version-specific facts (CVE-2020-11022/11023, jQuery < 3.5.0) not isolated in a deprecated section, keep it from being a clean 3.	3 / 3
Actionability	Provides fully executable, copy-paste-ready guidance: bash grep/curl one-liners, a JavaScript console scanner for clobberable globals, a navigator.serviceWorker.register block, complete HTML PostMessage PoC pages, and a runnable Python CSS-exfil payload generator — matching the score-3 "fully executable code/commands; copy-paste ready" anchor rather than the pseudocode-only score-2 level.	3 / 3
Workflow Clarity	Six phases are clearly sequenced with explicit validation checkpoints and feedback loops — per-phase callouts ("No OOB callback = no finding", "SecurityError => wrong origin/scope", persistence test via close-tab/reopen), a dedicated Validation section, and a finding→chain→impact table — satisfying the score-3 anchor; the missing-validation cap for risky/destructive operations does not apply because validation is emphatically present.	3 / 3
Progressive Disclosure	There are no bundle files (references/scripts/assets absent) and the skill is a single ~270-line SKILL.md with no external references; although it is well-sectioned (not a flat wall of text), the six full phases with complete PoCs are inline reference-grade material that "should be separate" per the rationale, matching the score-2 anchor rather than score-3 (which requires one-level-deep external references) — and the under-50-line simple-skill exemption does not apply.	2 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and distinctive: it enumerates concrete DOM vulnerability classes with their mechanisms, supplies an explicit Use-when trigger clause covering natural security-tester terms, and occupies a clear niche unlikely to conflict with other skills. It is in third-person/imperative voice with no first/second-person phrasing.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions with mechanism detail — "DOM Clobbering (overwrite JS globals via HTML injection)", "PostMessage hijacking (missing origin check)", "Service Worker abuse (intercept requests from same-origin script)", "CSS Injection/Exfiltration (attribute selectors → token char-by-char via OOB)" — matching the score-3 anchor rather than the score-2 "names domain and some actions" level.	3 / 3
Completeness	Clearly answers both what (the enumerated DOM bug classes) and when via an explicit "Use when hunting DOM-XSS, client-side auth bypass, or token exfiltration without server-side interaction" clause, matching the score-3 anchor; it is not the score-2 case where "when is missing or only implied".	3 / 3
Trigger Term Quality	Good coverage of natural security-tester terms in the Use-when clause ("DOM-XSS", "client-side auth bypass", "token exfiltration") plus the core niche keywords (PostMessage, Service Worker, CSS Injection); the CVE/research-provenance terms are jargon-heavy but the explicit trigger set is strong, so it clears the score-2 "missing common variations" bar.	3 / 3
Distinctiveness Conflict Risk	A clear narrow niche — client-side DOM vulnerabilities with no server-side interaction — and distinct triggers that would not fire for a server-side XSS or generic web-audit skill, matching the score-3 "clear niche with distinct triggers" anchor.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-dom/SKILL.md
Commit: 6b9c96e

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.