The Agent Skills Directory

[SAFE]: The skill serves as an educational resource for OWASP A07
Cross-Site Scripting (XSS) prevention. It contains no executable malicious code or suspicious instructions.
[SAFE]: Code snippets demonstrating vulnerabilities (e.g., innerHTML, dangerouslySetInnerHTML, eval) are correctly labeled as vulnerable and used for pedagogical purposes to contrast with secure implementations.
[SAFE]: The recommended secure implementations utilize standard security practices and libraries, such as HTML entity encoding, context-aware escaping, Content Security Policy (CSP) headers via the helmet middleware, and HTML sanitization using DOMPurify.
[SAFE]: External references to tools like xsstrike.py and libraries like dompurify, jsdom, and helmet are appropriate and well-known within the web security community.
[SAFE]: The skill promotes defense-in-depth strategies, including the use of HttpOnly cookies and framework-specific auto-escaping features.

xss-prevention