CtrlK
BlogDocsLog inGet started
Tessl Logo

xss-html-injection

This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.

63

Quality

74%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/xss-html-injection/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with concrete payloads and a clearly sequenced six-phase workflow, but it is over-long for a single file, restates material Claude already knows, and lacks the explicit validation/verification checkpoints a destructive testing workflow requires. Splitting payload catalogs and examples into reference files would improve both conciseness and progressive disclosure.

Suggestions

Add explicit validation/verification checkpoints to the workflow (e.g., confirm payload executed in the target context, re-confirm scope before exploiting stored XSS against real users, verify no unintended users are affected) to satisfy the destructive/batch-operation feedback-loop requirement.

Move the large payload catalogs (filter bypasses, encoding bypasses, common payloads table) and worked Examples into separate reference files in ./references/, keeping SKILL.md as a lean overview with one-level-deep links.

Trim redundant restatements of common knowledge (lists of generic dangerous sinks/sources, basic XSS payload forms) to assume Claude's competence and reduce token cost.

DimensionReasoningScore

Conciseness

The ~490-line body is mostly efficient reference-style payload catalogs rather than basic-concept prose, but it still spends many tokens restating common XSS payloads, dangerous sinks/sources, and filter-bypass techniques Claude already knows, and could be tightened.

3 / 5

Actionability

Provides extensive concrete, copy-paste-ready payloads and worked examples (cookie theft, keylogger, session hijack, CSP/JSONP bypass, encoding bypasses), covering common cases with minor gaps around tool-driven end-to-end workflows.

4 / 5

Workflow Clarity

Six phases are clearly sequenced, but for a destructive/attack skill with batch operations the workflow lacks explicit validation/verification checkpoints and feedback loops (confirm payload executed, verify scope before stored-XSS exploitation), capping this at 3 per the rubric.

3 / 5

Progressive Disclosure

No bundle files exist, and the entire payload catalog, examples, and troubleshooting are inlined in a single ~490-line SKILL.md with no file-level split, though section headers provide reasonable internal structure.

3 / 5

Total

13

/

20

Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is well-constructed: it explicitly states what the skill does and when to use it, using six natural quoted trigger phrases with good synonym coverage. It is third-person, concise, and largely free of fluff, with only minor generic-verb weakness in the 'what' clause.

DimensionReasoningScore

Specificity

Names several concrete actions ('detecting, exploiting, and understanding XSS and HTML injection attack vectors') and the quoted triggers name verbs (test, perform, identify, exploit, steal, bypass), but the actions are somewhat generic ('comprehensive techniques') rather than exhaustive.

4 / 5

Completeness

Explicitly answers both 'what' (techniques for detecting, exploiting, and understanding XSS/HTMLi vectors) and 'when' ('should be used when the user asks to...' with concrete trigger phrases), matching the top anchor.

5 / 5

Trigger Term Quality

Quotes six natural user phrases ('test for XSS vulnerabilities', 'perform cross-site scripting attacks', 'steal cookies via XSS', 'bypass content security policies') with strong synonym coverage (XSS / cross-site scripting / HTML injection).

5 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (XSS/HTML injection testing) with distinct triggers and minimal conflict risk; only minor overlap with general web-pentest skills.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zebbern/claude-code-guide
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.