CtrlK
BlogDocsLog inGet started
Tessl Logo

sast-xss

Detect Cross-Site Scripting (XSS) vulnerabilities in a codebase using a three-phase approach: recon (find HTML/JS/DOM sink sites), batched verify (trace user input to sinks in parallel subagents, 3 sink sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/xss-results.md. Use when asked to find XSS or cross-site scripting bugs.

68

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete code and complete subagent orchestration prompts, but it is verbose — repeating sink patterns across three sections and explaining XSS fundamentals Claude already knows — and monolithic rather than split across reference files. It is a strong, usable skill that would benefit from trimming redundant concept sections and externalizing the large reference tables.

Suggestions

Consolidate the framework sink lists into a single canonical table: the 'What XSS IS' section, the 'Vulnerable vs. Secure Examples', and the Phase 1 'What to search for' list overlap heavily and could share one reference, removing the two redundant passes.

Trim the conceptual 'What is XSS', 'XSS Types', and 'Patterns That Prevent XSS' introductions to a one-line definition plus links, since Claude already knows XSS fundamentals; keep only the framework-specific sink/safe-pattern reference.

Move the large per-framework vulnerable/secure examples and sink reference tables into a references/ file (e.g. references/sink-patterns.md) and signal it from SKILL.md, so the main file stays a lean overview and progressive disclosure reaches score 3.

DimensionReasoningScore

Conciseness

While much of the body is concrete reference material, the 'What is XSS', types, and prevention sections explain concepts Claude already knows, and the framework sink lists are repeated three times (lines ~34-77, ~165-352 examples, ~372-409 Phase 1 instructions), which is tightening-eligible padding rather than fully lean.

2 / 3

Actionability

Provides fully executable vulnerable-vs-secure code per framework, exact subagent prompts, precise batching rules, and copy-paste-ready markdown output templates — copy-paste ready and complete.

3 / 3

Workflow Clarity

The recon → verify → merge phases are clearly sequenced with a Phase-1 go/no-go checkpoint, but this is a batch operation with no validate→fix→retry feedback loop on subagent output, so per the rubric feedback_loops note workflow_clarity is capped at 2.

2 / 3

Progressive Disclosure

Sections are clearly organized, but the skill is monolithic (~600 lines, no references/scripts/assets bundle files) and the large framework-specific sink tables and code examples that could be split into reference files are all inline; it is not under the 50-line simple-skill threshold that would excuse the absence of separate files.

2 / 3

Total

9

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A concise, specific, third-person description that clearly states both capabilities and trigger conditions, with natural user keywords and a distinct niche. It is well above the score-2 anchors on every dimension and needs no revision.

DimensionReasoningScore

Specificity

Names multiple concrete actions: 'recon (find HTML/JS/DOM sink sites)', 'batched verify (trace user input to sinks in parallel subagents, 3 sink sites each)', and 'merge (consolidate batch results)', matching the score-3 anchor of listing several specific concrete actions.

3 / 3

Completeness

Explicitly answers both 'what' (three-phase XSS detection with named phases and outputs) and 'when' ('Use when asked to find XSS or cross-site scripting bugs'), matching the score-3 anchor.

3 / 3

Trigger Term Quality

Covers natural user terms — 'Cross-Site Scripting (XSS)', 'find XSS', and 'cross-site scripting bugs' — that a user would naturally say when requesting this skill.

3 / 3

Distinctiveness Conflict Risk

Targets a clear XSS-detection niche with distinct triggers ('find XSS', 'cross-site scripting') and an explicit prerequisite, making it unlikely to fire for unrelated skills.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (622 lines); consider splitting into references/ and linking

Warning

Total

15

/

16

Passed

Repository
utkusen/sast-skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.