What problem does it solve? Reflected XSS testing often produces false positives from raw reflection that never executes, or misses context-specific sinks hidden behind redirects, Markdown renderers, and media proxies. This Skill provides a disciplined method to trace attacker-controlled input to a real executable sink and prove target-origin execution before reporting. ## Core Features & Use Cases - Context-driven payload selection: Send inert canaries through query, path, form, and redirect parameters, then derive minimal payloads matching the observed sink (HTML text, attribute, URL navigation, path segment). - Advanced sink coverage: Test Markdown URL sinks, HEAD/GET validation mismatches in media proxies, and CSP nonce/allowlist gadget chains after proving injection. - Negative-control discipline: Apply eight categorized stop conditions (expected behavior, self-XSS, out-of-scope assets, patched versions) so unverifiable or below-threshold findings are never filed. - Use Case: During a bug-bounty engagement, you notice a returnTo parameter reflected in a post-login Continue action. Use this Skill to confirm a javascript: navigation payload executes under the target origin in a clean browser session, then document the DOM, CSP, and interaction prerequisites for the report. ## Quick Start Use the xss-reflected-hunter skill to test the returnTo parameter on the target's login confirmation page for reflected XSS with a console canary.
