skills.rest
sjinks
sjinksCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-review-owasp-cross-site-scripting-prevention

Review application code and templates for cross-site scripting prevention paths.

Updated Mar 26, 2026
Search Tags:#xss#owasp#sanitization#security review#cross-site scripting#output encoding#dom sinks
One-click install
npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-cross-site-scripting-prevention
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review-owasp-cross-site-scripting-prevention
Source: https://github.com/sjinks/ai-owasp-skillset/tree/main/.github/skills/security-review-owasp-cross-site-scripting-prevention
Command: npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-cross-site-scripting-prevention

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Helps you review code paths that turn untrusted input into browser-executable output, so cross-site scripting issues are found before release.

Core Features & Use Cases

  • Checks server-rendered views, component rendering, and client-side DOM updates for unsafe HTML, script, style, attribute, and URL contexts.
  • Reviews framework escape hatches, sanitization logic, safe sink usage, and output encoding choices against OWASP guidance.
  • Useful for security reviews of authentication pages, comment systems, rich-text previews, dashboards, webhooks, and any feature that renders user-controlled content.

Quick Start

Ask me to review the specified files or rendering flow for XSS prevention issues using this skill.

Frequently Asked Questions about security-review-owasp-cross-site-scripting-prevention

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review code for cross-site scripting vulnerabilities before release?▼

To prevent cross-site scripting, review untrusted input paths turning into browser-executable output across server-rendered views and client-side DOM sinks. This Skill validates output encoding, safe sink usage, and sanitization logic against OWASP guidance.

What is the best way to sanitize user-authored HTML and prevent XSS in rich-text previews?▼

Sanitizing user-authored HTML requires context-specific output encoding and safe DOM sink usage. This Skill reviews sanitization logic and framework escape hatches in rendering flows to ensure user-controlled content is safely handled before display.

How do I check DOM sinks and framework escape hatches for unsafe HTML injection?▼

Check DOM sinks and framework escape hatches by reviewing client-side DOM updates and component rendering for unsafe HTML, script, style, attribute, and URL contexts. This Skill identifies unsafe sink usage and validates appropriate encoding choices.

Does this XSS prevention review work for server-rendered views and client-side rendering?▼

This XSS prevention review covers both server-rendered views and client-side DOM updates. It evaluates context-specific encoding across code, configuration, and architecture for authentication pages, dashboards, and webhooks.

What are the limitations of relying on output encoding for cross-site scripting prevention?▼

Output encoding limitations arise when sanitization logic is incomplete or framework escape hatches bypass default protections. This Skill reports confirmed findings, review gaps, and passed checks, highlighting where encoding alone fails to secure unsafe DOM sinks.

Related Skills

Explore More Software Engineering Skills→
AytsuuAytsuu

security-review

Validate source code for common security vulnerabilities across multiple domains.

Community
Advanced
sjinkssjinks

security-review-owasp-database-security

Identify database security weaknesses in code, configuration, and infrastructure.

Community
Advanced
philo-grovesphilo-groves
12

maxtac-sast-control-flow-graph

Construct static analysis graphs for reachability, guard dominance, and path feasibility.

Community
Advanced
seb1nseb1n
147

static-application-security-testing

Run SAST scans with Semgrep and CodeQL to detect vulnerabilities in source code.

Community
Advanced