What problem does it solve? Security testers often get false positives from scanners that flag reflected input without proving actual script execution. This Skill provides an evidence-gated workflow to confirm whether an untrusted canary truly executes in server, DOM, template, attribute, or URL contexts, separating real XSS from scanner noise. ## Core Features & Use Cases - Evidence-Gated Validation: Confirms XSS only when a self-owned, non-exfiltrating canary actually executes in an isolated browser, verified via DevTools console, network, and CSP reports. - Context-Aware Probing: Covers reflected, stored, DOM, HTML, JavaScript, attribute, and URL contexts with a baseline → single-variable probe → post-baseline → oracle → evidence loop. - Strict Safety Boundaries: Stops immediately on cookie/token reading, phishing, third-party impact, cross-tenant storage, or external callbacks; routes DOM issues to hunt-dom and session/CSRF impact to chain-review. - Use Case: During an authorized web assessment, a scanner reports a reflected parameter. Use this Skill to determine whether the reflection actually executes in the browser or is neutralized by encoding or CSP, producing reproducible evidence. ## Quick Start Use the hunt-xss skill to validate whether the reflected search parameter on my authorized test target actually executes a canary in the browser.
