Detect Cross-Site Scripting vulnerabilities by tracing user input through rendering sinks.
npx skills add https://github.com/utkusen/sast-skills --skill sast-xss
Please help me install this Agent Skill. Skill: sast-xss Source: https://github.com/utkusen/sast-skills/tree/main/sast-files/.agents/skills/sast-xss Command: npx skills add https://github.com/utkusen/sast-skills --skill sast-xss
Detect Cross-Site Scripting vulnerabilities across codebases by tracing user-controlled input through rendering sinks.
Run the XSS detection workflow against your project to surface sink sites and generate a consolidated xss-results.md.
High-intent search queries and answers about installing and using this skill.
To find XSS vulnerabilities, this Skill traces unescaped user input through server-side template sinks, client-side DOM sinks, and JavaScript execution paths, generating a unified report of risky rendering patterns across the codebase.
Taint-tracking for cross-site scripting follows data flow from user-controlled inputs to rendering sinks. This Skill uses batched taint-tracking to verify if unescaped input reaches output paths, validating potential vulnerabilities across the codebase.
Run a static analysis workflow for XSS detection by executing a three-phase process: recon to locate sink sites, batched verify to taint-track input in parallel, and merge to produce a unified vulnerability report in sast/xss-results.md.
Yes, code analysis for XSS vulnerabilities requires sast/architecture.md as architectural context to map sinks and data flows, enabling the Skill to accurately locate template sinks and trace user input paths before generating reports.
The best way to analyze large codebases for cross-site scripting is using batched parallel verification, which taint-tracks user input across JavaScript execution paths in parallel batches, ensuring comprehensive sink coverage and unified results.
Static code analysis for XSS in client-side templates requires architectural context to map data flows and may need manual review of dynamically generated DOM updates, as automated taint-tracking focuses on identified sink sites and execution paths.
utkusenMap user-controlled data to dangerous sinks and write RCE findings to rce-results.md.
xalgordDetect and analyze DOM-based XSS vulnerabilities in client-side applications.
yldst-devGuide AI-assisted secure coding for web applications to prevent XSS, CSRF, SQL Injection, SSRF, and access control flaws.
MAF2414Trace user-controlled input from sources to dangerous sinks to detect injection vulnerabilities.
