The Agent Skills Directory

[SAFE]: The skill is a legitimate security testing resource that provides educational content on XSS hunting techniques based on bug bounty report analysis.
[OBFUSCATION]: The skill contains examples of obfuscated JavaScript payloads (e.g., atob('YWxlcnQoMSk=') and \u0072t) within Markdown code blocks. These are documented techniques for testing WAF bypasses and do not represent obfuscation of the skill's own instructions or logic.
[INDIRECT_PROMPT_INJECTION]: The skill outlines a methodology for an agent to process untrusted data from external target websites to find reflection points.
Ingestion points: External website response bodies fetched during spidering and vulnerability probing (SKILL.md).
Boundary markers: The instructions mandate the use of unique, random alphanumeric canary strings (e.g., cpmark987abc) to distinguish injected payloads from legitimate site content.
Capability inventory: The skill uses network communication (via curl) and browser-based testing to verify script execution.
Sanitization: The methodology relies on baseline comparisons and browser-side verification to ensure injected payloads are not misinterpreted due to existing site data.

hunt-xss