payloads-xss-polyglots
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEOBFUSCATION
Full Analysis
- [OBFUSCATION]: The polyglot payload string contains hex-encoded characters (\x3c for \u003c and \x3e for \u003e) and URL-encoded line breaks (%0D%0A). These are functional components of the XSS payload designed to be syntactically valid in multiple contexts (HTML, JavaScript, and attributes) and do not represent malicious obfuscation of the skill's own logic.\n- [SAFE]: This is a documentation-only resource that does not execute code, perform network requests, or access sensitive files. The presence of security payloads is consistent with the skill's stated purpose for pentesting and bug bounty research.
Audit Metadata