hunt-xss

Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflects raw HTML but does NOT execute JavaScript (no `<script>`/event-handler execution), see hunt-html-injection — escalate here once script execution is possible.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-xss/SKILL.md

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-gated hunting skill with strong workflows; its weaknesses are narrative verbosity in the impact/chain sections and a monolithic structure that forgoes progressive disclosure into reference files.

Suggestions

Tighten the "Real Impact Examples" and chain "Real shape" prose into compact bullets to reclaim tokens without losing the source citations.

Move the payload/bypass bank and the detailed chains into reference files (e.g., references/payloads.md, references/chains.md) and have SKILL.md overview + link to them for genuine progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is dense and mostly actionable, but multi-paragraph narrative passages (Real Impact Examples, chain "Real shape" prose) pad the token budget where leaner bullets would carry the same signal.	2 / 3
Actionability	Copy-paste payloads, curl/grep commands, specific bypass strings, and a 12-step methodology give fully executable, concrete guidance throughout.	3 / 3
Workflow Clarity	A clear sequenced methodology is reinforced by explicit validation gates (Gate 0, OOB-Or-It-Didn't-Happen, marker discipline, "Validate in target browser") with feedback loops for false positives.	3 / 3
Progressive Disclosure	Well-organized into labeled sections, but it is a monolithic ~450-line SKILL.md with no bundle files and no file-level offloading of the payload bank or chains that would benefit from being split out.	2 / 3
	Total	10 / 12 Passed

Description

75%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A clear, well-triggered description with strong distinctiveness and an explicit Use-when clause; its main weakness is reliance on the single keyword "xss" and only one stated capability.

Suggestions

Add the spelled-out term "cross-site scripting" and a couple of natural variants (e.g., "reflected/stored XSS", "script injection") so users who phrase it differently still match.

Mention concrete hunting actions (e.g., "probe reflection points, test sanitizer bypasses, chain XSS into account takeover") to lift specificity beyond the single word "hunting".

Dimension	Reasoning	Score
Specificity	Names the domain ("xss vulnerabilities") and a core action ("hunting") plus a built-from-reports provenance, but stays at one capability rather than enumerating multiple concrete actions.	2 / 3
Completeness	Clearly states what it does ("Hunting skill for xss vulnerabilities") and an explicit trigger ("Use when hunting xss on any target"), answering both what and when.	3 / 3
Trigger Term Quality	Uses the natural term "xss" repeatedly but omits common variations a user might say ("cross-site scripting", "script injection", "reflected/stored XSS").	2 / 3
Distinctiveness Conflict Risk	Explicit boundary guidance to hunt-html-injection and an "escalate here once script execution is possible" rule give it a clear niche unlikely to trigger the wrong skill.	3 / 3
	Total	10 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 2 suspicious	Warning

	Total	14 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-xss/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.