html-injection-testing

This skill should be used when the user asks to "test for HTML injection", "inject HTML into web pages", "perform HTML injection attacks", "deface web applications", or "test content injection vulnerabilities". It provides comprehensive HTML injection attack techniques and testing methodologies.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/html-injection-testing/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with extensive executable code and payloads, but it is verbose, monolithic, and lacks the validation/feedback checkpoints and authorization gating expected for destructive and batch offensive operations.

Suggestions

Add explicit validation/verification checkpoints after each testing phase (e.g., confirm an injection rendered before escalating payloads, re-test after WAF/filter interaction) and an authorization/safety gate before any destructive or phishing payload is used.

Split the large payload catalogs (basic payloads, bypass techniques, encoding tables, the fuzzer wordlist) into reference files under references/ and link to them one level deep, so SKILL.md stays a concise overview.

Trim conceptual padding Claude already knows (definitions of HTML injection, the XSS-vs-HTML-injection primer) to improve token efficiency.

Dimension	Reasoning	Score
Conciseness	The ~490-line body is mostly a payload reference but includes unnecessary conceptual explanation Claude already knows (e.g., defining HTML injection, "Key differences from XSS") and could be tightened throughout.	3 / 5
Actionability	Abundant copy-paste-ready, executable guidance: curl test commands, HTML payload blocks, a complete runnable Python fuzzer, and remediation code in PHP, Python, and JavaScript covering the common cases.	5 / 5
Workflow Clarity	The ten phases are sequenced, but there are no explicit validation checkpoints or success/failure feedback loops, and the destructive/offensive batch operations (defacement, phishing, automated fuzzing) lack validation — which per the rubric caps this dimension at 3.	3 / 5
Progressive Disclosure	No bundle files exist and all content is inlined as a single ~490-line monolith; section headers provide some structure, but large payload catalogs, bypass lists, and encoding tables that belong in separate files are inlined with no references.	3 / 5
	Total	14 / 20 Passed

Description

77%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has excellent, explicit trigger-term coverage and clearly answers both what the skill does and when to use it. Its main weakness is that the "what" stays generic ("techniques and methodologies") rather than naming concrete capabilities.

Dimension	Reasoning	Score
Specificity	Names the domain and gestures at actions ("comprehensive HTML injection attack techniques and testing methodologies"), but the actions are generic rather than the several concrete, specific actions the higher anchors require.	3 / 5
Completeness	Both a clear "when" (the explicit "when the user asks to..." clause) and a "what" are present, but the "what" is generic ("comprehensive... techniques and methodologies") rather than concrete trigger phrases, keeping it just below the top anchor.	4 / 5
Trigger Term Quality	Five natural quoted trigger phrases users would actually say are listed ("test for HTML injection", "inject HTML into web pages", "deface web applications", "test content injection vulnerabilities"), giving comprehensive coverage with synonyms.	5 / 5
Distinctiveness Conflict Risk	HTML injection with triggers like "deface web applications" and "content injection vulnerabilities" carves a mostly distinct niche, with only minor overlap risk against closely related XSS-testing skills.	4 / 5
	Total	16 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/html-injection-testing/SKILL.md
Commit: 59c5fc4

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.