What problem does it solve? Embedded widgets, payment iframes, and cross-origin integrations often register window.postMessage listeners with missing or weak origin checks, turning them into data-exfiltration primitives. This Skill provides a repeatable methodology to find those listeners, classify their sinks, bypass flawed origin checks, and prove real impact instead of reporting theoretical findings. ## Core Features & Use Cases - Listener Sweep and Triage: Grep first-party JavaScript bundles for addEventListener("message") and onmessage handlers while excluding non-exploitable MessageChannel polyfills and Web Worker handlers. - Sink Classification and Origin-Check Analysis: Trace event.data flows into tokenization URLs, encryption keys, storage writes, navigation, and DOM sinks, then evaluate origin checks for regex suffix flaws, .includes() bypasses, and coercion issues. - End-to-End Proof via CDP: Drive a real browser from a file:// page or window.open() popup to demonstrate the sink fires, accounting for storage-partitioning differences between iframes and popups. - Use Case: During an assessment of an embedded payment iframe, you discover its origin check accepts any domain matching a .com.br suffix regex, letting an attacker-controlled page supply the tokenization URL and RSA key to exfiltrate PAN/CVV data. ## Quick Start Audit the target site's JavaScript for postMessage listeners with weak origin checks and prove exploitability using a browser-driven proof of concept.
