hunt-xss

Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflects raw HTML but does NOT execute JavaScript (no `<script>`/event-handler execution), see hunt-html-injection — escalate here once script execution is possible.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An expert-grade XSS hunting playbook: highly actionable payloads and commands, strong validation gates that prevent false-positive reports, and clear cross-skill chaining. Its main weakness is conciseness — some prose scenarios and a few repeated explanations could be trimmed, and the payload/chain material could be split into reference files.

Suggestions

Trim the prose 'Real Impact Examples' scenarios or compress them to one-liners; the concrete chain sections already convey the same impact more efficiently.

Factor the 'Payload & Detection Patterns' and 'Chains & Compositions' sections into reference files (e.g. PAYLOADS.md, CHAINS.md) referenced one level deep from SKILL.md to reduce the inlined 449-line footprint.

Dedupe the canary/uniqueness guidance that appears in both 'Autonomous Testing Priority' and step 3 'Marker Discipline' into a single canonical statement.

Dimension	Reasoning	Score
Conciseness	Dense and information-rich with almost no 'what is XSS' padding — payloads, grep/curl commands, and citations earn their tokens — but prose 'Real Impact Examples' and some repeated canary/marker exposition keep it just short of the lean anchor 5.	4 / 5
Actionability	Fully executable, copy-paste-ready guidance across the common cases: exact payloads for reflected/attribute/SVG/markdown/DOM contexts, curl reflection checks, grep patterns, and specific URL/header vectors; the only placeholders (AngularJS hard variant) are explicitly justified as parameterized.	5 / 5
Workflow Clarity	A 12-step methodology is clearly sequenced and reinforced by explicit validation gates ('Verify reflection before claiming XSS', encoded-vs-unescaped success/failure criteria, 'OOB-Or-It-Didn't-Happen Gate', 'Gate 0 Validation') with feedback loops for false-positive recovery.	5 / 5
Progressive Disclosure	Well-organized with clear section headers and clearly signaled cross-references to related skills, but no bundle files exist and substantial payload/chain detail that could live in separate reference files is inlined into one 449-line document.	4 / 5
	Total	18 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A tight, well-scoped description that states what the skill does, when to use it, and how it differs from the closely related markup-injection skill. It avoids fluff and over-claims while packing in concrete, natural trigger terms.

Dimension	Reasoning	Score
Specificity	Names the XSS-hunting domain and several concrete actions (hunting XSS, distinguishing markup injection from script execution, escalation routing to hunt-html-injection), with only minor coverage gaps versus the comprehensive anchor 5.	4 / 5
Completeness	Explicitly answers both what ('Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports.') and when ('Use when hunting xss on any target.'), plus a concrete boundary clause for escalation.	5 / 5
Trigger Term Quality	Comprehensive natural-term coverage including synonyms and specifics a user would actually say: 'hunting xss', 'xss vulnerabilities', 'markup injection', 'reflects raw HTML', 'execute JavaScript', '<script>', and 'event-handler execution'.	5 / 5
Distinctiveness Conflict Risk	Clear XSS-hunting niche with an explicit disambiguation against hunt-html-injection and an escalation rule, keeping conflict risk with adjacent skills minimal.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 2 suspicious	Warning

	Total	14 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-xss/SKILL.md
Commit: 0ce18ba

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.