security-review-owasp-xss-filter-evasion

What problem does it solve?

Helps reviewers catch browser-side trust failures that let attacker-controlled content bypass XSS filters, execute in the DOM, or leak sensitive data through weak client-side controls.

Core Features & Use Cases

• DOM and Rendering Review: Inspect input flow into executable browser contexts, template escape hatches, storage, and postMessage handling.
• Policy and Boundary Review: Assess CSP, framing rules, mixed-content handling, sandboxing, and other browser-enforced protections for bypasses or inconsistent deployment.
• Third-Party Risk Review: Evaluate widgets, extensions, scripts, and external dependencies that expand client-side trust or exposure.
• Use Case: Review a web app’s frontend, response headers, and embedded scripts to determine whether an attacker can inject script, frame sensitive UI, or exfiltrate data across origins.

Quick Start

Use the security-review-owasp-xss-filter-evasion skill to review the target frontend code, headers, and browser interactions for XSS filter bypasses, framing abuse, and unsafe third-party script behavior.