payloads-xss
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONOBFUSCATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references established security tools and repositories on GitHub, including XSStrike, xsser, and Dalfox, as well as platforms like PortSwigger and Root Me. These are recognized resources in the cybersecurity community.
- [DATA_EXFILTRATION]: The documentation provides Proof-of-Concept payloads demonstrating how to exfiltrate cookies and local storage tokens using fetch or Image object requests to transmit data to a testing domain. These are presented for research and testing purposes.
- [OBFUSCATION]: The library includes payloads that utilize encoding techniques such as Base64 in data URIs and Hex/Octal character codes in URI wrappers to demonstrate common web application firewall (WAF) bypass strategies.
- [INDIRECT_PROMPT_INJECTION]: The skill provides a significant capability inventory of injection payloads. 1. Ingestion points: None (static skill instructions). 2. Boundary markers: Absent for the payload strings. 3. Capability inventory: Extensive collection of reflected, stored, and DOM-based XSS payloads. 4. Sanitization: No sanitization or validation logic is provided for the included strings.
Audit Metadata