What problem does it solve? Security researchers need a disciplined way to confirm whether their own cross-origin pages leak protected state through browser side channels (navigation, frames, cache, size, timing) without touching real user data or producing false positives. ## Core Features & Use Cases - Evidence-Gated Validation: Enforces a fixed baseline → single-variable probe → post-baseline → oracle → evidence workflow so every finding is reproducible. - Trigger Signal Detection: Recognizes cross_origin_frame, cache_state_difference, timing_side_channel, window_navigation_signal, and opaque_response indicators. - False-Positive Control: Treats single timing differences, WAF blocks, and scanner hits as INCONCLUSIVE, and routes CORS, cache, and redirect findings to the appropriate sibling skills. - Use Case: During an authorized assessment of your own web application, use this Skill to verify whether an attacker-controlled origin can distinguish logged-in versus logged-out states of your own test accounts via frame counting or cache timing. ## Quick Start Use $hunt-xs-leaks to plan an evidence-gated, authorized validation of whether my own cross-origin test pages leak protected state through browser side channels.
