CtrlK
BlogDocsLog inGet started
Tessl Logo

xss-html-injection

This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.

65

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/xss-html-injection/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a highly actionable XSS/HTMLi cookbook with concrete payloads and a clear phased workflow, but it is verbose and redundant and keeps all reference material inline rather than splitting it across bundle files.

Suggestions

Move the large payload catalog and filter-bypass encodings into a references file (e.g. references/payloads.md) and keep SKILL.md as a concise workflow overview with one-level-deep links, which would lift both conciseness and progressive_disclosure.

De-duplicate the cookie/session-stealing payloads that recur in Phase 2, Quick Reference, and Examples, and trim the conceptual Stored/Reflected/DOM "Indicators" lists since Claude already knows XSS taxonomy.

Insert explicit validation checkpoints between phases (e.g. "Confirm payload executed in the browser console before moving to exploitation") to convert the sequential phases into a verified workflow.

DimensionReasoningScore

Conciseness

Mostly actionable payload reference material, but ~500 lines with redundancy (cookie/session-stealing payloads repeat across Phase 2, Quick Reference, and Examples) and conceptual padding like the Stored/Reflected/DOM "Indicators" lists that Claude already knows.

2 / 3

Actionability

Provides concrete, copy-paste-ready payloads, real HTTP requests, URL-encoded attack URLs, and executable JavaScript across every phase — fully actionable rather than described.

3 / 3

Workflow Clarity

A clear Phase 1–6 sequence plus a detection checklist and troubleshooting feedback table exists, but there are no explicit validation/verification gates between phases for a task with destructive potential, capping this at 2 per the rubric.

2 / 3

Progressive Disclosure

No bundle files exist and the entire payload/bypass reference is inline in one ~500-line SKILL.md; well-organized by section, but content that would be better split into reference files (e.g. a payloads or bypass-techniques reference) is not separated.

2 / 3

Total

9

/

12

Passed

Description

90%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly states what the skill does and when to invoke it, with strong, natural trigger terms and a distinct niche. The only weakness is the slightly abstract capability verb list padded with "comprehensive techniques."

Suggestions

Replace "provides comprehensive techniques for detecting, exploiting, and understanding" with concrete operations, e.g. "detects, exploits, and reports XSS/HTML injection flaws across stored, reflected, and DOM-based vectors."

DimensionReasoningScore

Specificity

"provides comprehensive techniques for detecting, exploiting, and understanding" names several actions, but "comprehensive" is vague fluff and the verbs are more abstract than the concrete multi-action examples at level 3.

2 / 3

Completeness

Explicitly answers both: when ("should be used when the user asks to…") and what ("provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors").

3 / 3

Trigger Term Quality

Quotes natural phrasings a user would say — "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "steal cookies via XSS", "bypass content security policies" — covering common variations well.

3 / 3

Distinctiveness Conflict Risk

Targets a clear niche (XSS/HTML injection testing) with distinct trigger terms unlikely to fire for unrelated skills.

3 / 3

Total

11

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zebbern/claude-code-guide
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.