scanning-for-xss-vulnerabilities
tessl i github:jeremylongshore/claude-code-plugins-plus-skills --skill scanning-for-xss-vulnerabilitiesThis skill enables Claude to automatically scan for XSS (Cross-Site Scripting) vulnerabilities in code. It is triggered when the user requests to "scan for XSS vulnerabilities", "check for XSS", or uses the command "/xss". The skill identifies reflected, stored, and DOM-based XSS vulnerabilities. It analyzes HTML, JavaScript, CSS, and URL contexts to detect potential exploits and suggests safe proof-of-concept payloads. This skill is best used during code review, security audits, and before deploying web applications to production.
Validation
81%| Criteria | Description | Result |
|---|---|---|
metadata_version | 'metadata' field is not a dictionary | Warning |
license_field | 'license' field is missing | Warning |
body_output_format | No obvious output/return/format terms detected; consider specifying expected outputs | Warning |
Total | 13 / 16 Passed | |
Implementation
20%This skill content reads like marketing copy rather than actionable technical guidance. It describes what the skill does conceptually but provides no concrete detection patterns, code examples, XSS payloads, or specific analysis techniques. Claude needs executable guidance on HOW to detect XSS, not descriptions of what detection looks like.
Suggestions
Replace abstract descriptions with concrete code examples showing vulnerable patterns and how to identify them (e.g., innerHTML assignments, document.write calls, unsanitized template interpolation)
Add specific XSS payload examples for each context (HTML, JavaScript, URL, CSS) that Claude should look for or test
Include a concrete detection checklist with specific code patterns to grep/search for (e.g., 'innerHTML =', 'eval(', 'document.location')
Remove the 'How It Works' and 'Best Practices' sections entirely - Claude knows what XSS is and how sanitization works; focus on detection methodology
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Extremely verbose with unnecessary explanations Claude already knows (what XSS is, what sanitization means, generic best practices). The 'How It Works' section describes plugin behavior rather than providing actionable guidance. Much of the content is filler that doesn't add value. | 1 / 3 |
Actionability | No concrete code examples, detection patterns, or executable commands. The examples describe what 'the skill will do' abstractly rather than showing actual code snippets, payloads, or specific detection techniques Claude should use. | 1 / 3 |
Workflow Clarity | Steps are listed in 'How It Works' but they describe abstract plugin behavior rather than actionable steps Claude should take. No validation checkpoints, no specific detection methodology, and no feedback loops for handling false positives or edge cases. | 2 / 3 |
Progressive Disclosure | Content is organized into sections but everything is inline with no references to detailed materials. The skill would benefit from linking to payload lists, context-specific detection rules, or remediation guides rather than including generic best practices inline. | 2 / 3 |
Total | 6 / 12 Passed |
Activation
100%This is a well-crafted skill description that excels across all dimensions. It provides specific capabilities (types of XSS detected, contexts analyzed), explicit trigger terms including a command shortcut, and clear use-case guidance. The description uses proper third-person voice and maintains a clear, distinct focus on XSS security scanning.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: 'scan for XSS vulnerabilities', 'identifies reflected, stored, and DOM-based XSS vulnerabilities', 'analyzes HTML, JavaScript, CSS, and URL contexts', 'suggests safe proof-of-concept payloads'. | 3 / 3 |
Completeness | Clearly answers both what (scans for XSS, identifies vulnerability types, analyzes contexts, suggests payloads) AND when (explicit triggers like 'scan for XSS', '/xss' command, plus contextual triggers like 'code review', 'security audits', 'before deploying'). | 3 / 3 |
Trigger Term Quality | Includes natural keywords users would say: 'scan for XSS vulnerabilities', 'check for XSS', '/xss' command, 'code review', 'security audits', 'web applications'. Good coverage of both explicit triggers and contextual use cases. | 3 / 3 |
Distinctiveness Conflict Risk | Clear niche focused specifically on XSS vulnerabilities with distinct triggers ('/xss' command, 'XSS' keyword). Unlikely to conflict with general code review or other security scanning skills due to the specific XSS focus. | 3 / 3 |
Total | 12 / 12 Passed |
Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.