Encode output by context and implement CSP to mitigate XSS vulnerabilities.
npx skills add https://github.com/hung-phan/system-skills --skill xss-hung-phan
Please help me install this Agent Skill. Skill: xss Source: https://github.com/hung-phan/system-skills/tree/main/skills/system-review/references/security/xss Command: npx skills add https://github.com/hung-phan/system-skills --skill xss-hung-phan
This Skill provides comprehensive defenses against Cross-Site Scripting (XSS), addressing stored, reflected, and DOM-based XSS vulnerabilities with a focus on output encoding by context, Content Security Policy, and other strategies.
Use the xss skill to sanitize the HTML output from the user's comment.
High-intent search queries and answers about installing and using this skill.
Preventing XSS vulnerabilities requires applying context-aware output encoding and HTML sanitization to user-generated content before rendering it in the browser. This ensures malicious scripts embedded in user input are neutralized and safely displayed as text.
Context-aware output encoding for XSS prevention is the practice of encoding untrusted data differently depending on where it is placed in the document, such as within HTML, JavaScript, URL, or CSS contexts. This stops context confusion attacks by ensuring data is treated strictly as content.
You can implement a Content Security Policy (CSP) to block malicious scripts by configuring your web application to restrict content sources and explicitly define approved script origins. This mitigation strategy restricts resource loading and prevents unauthorized inline script execution.
The best way to sanitize HTML input against stored and reflected XSS attacks is using dedicated HTML sanitization techniques to safely process user-generated content. Sanitizers strip dangerous tags and attributes while preserving safe formatting before the data reaches the DOM.
HTML encoding alone does not fully protect against DOM-based XSS vulnerabilities, because DOM-based attacks occur when user input is executed directly within the client-side Document Object Model. You must combine context-aware encoding, HTML sanitization, and Content Security Policy for comprehensive defense.
Andreicr1Analyzes specifications to map user flows, detect gaps, and output clarifying questions.
carloitabenAudit web code for security, compatibility, and code quality best practices.
cwinvestmentsAudit, generate, and fix HTTP security headers including CSP, HSTS, and X-Frame-Options.
archview-aiSanitize untrusted HTML input to mitigate XSS risks in WebF applications.
