The Agent Skills Directory

[SAFE]: The skill functions as a documentation and methodology resource for authorized security assessments, focusing on the identification and validation of XSS vulnerabilities.
[OBFUSCATION]: The skill includes a Base64-encoded string (YWxlcnQoMSk=) within a sample XSS payload. This string decodes to alert(1), which is a benign and standard proof-of-concept command for demonstrating script execution during security testing.
[COMMAND_EXECUTION]: The skill provides templates for grep and curl commands intended for source code analysis and probing network reflections. These tools are standard for vulnerability research, and the skill explicitly requires mandatory user confirmation before any active probes are executed.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from target applications (e.g., URL parameters, response bodies). While this presents a theoretical injection surface, the skill mitigates this by instructing the user to employ unique, random alphanumeric canary strings to verify reflections, rather than relying on automated interpretation of external content.
[DYNAMIC_EXECUTION]: The skill mentions the use of eval() in the context of identifying dangerous sinks in target JavaScript code and provides testing examples using eval(atob(...)). These are documented as reference techniques for security researchers and are not used for malicious operations by the skill itself.

hunt-xss