What problem does it solve? Client-side vulnerabilities like DOM XSS, insecure postMessage handlers, and Service Worker abuse are hard to confirm because static reflection or console errors do not prove exploitability. This Skill provides an evidence-gated workflow to verify browser-side source-to-sink data flows, origin checks, and storage/navigation trust boundaries without false positives. ## Core Features & Use Cases - Trigger-Based Scoping: Activates on signals such as dom_sink, postmessage_listener, service_worker, client_side_router, local_storage_token, and unsafe_url_sink. - Evidence-Gated Validation: Requires a baseline, single-variable probe, post-baseline comparison, and a browser oracle showing a complete source-to-sink trace before confirming a finding. - Safe Canary Testing: Uses harmless canaries in an isolated browser on your own origin, never reading real localStorage tokens or third-party data. - Use Case: During an authorized web assessment, you find a postMessage listener in a JavaScript bundle. Use this Skill to verify whether messages from an untrusted origin actually reach a dangerous DOM sink, with DevTools traces as evidence. ## Quick Start Use the hunt-dom skill to plan an evidence-gated validation of the postMessage listener and DOM sinks on my authorized test origin.
