What problem does it solve? Stored XSS is hard to confirm because reflection at submission time proves nothing; you need persistence plus execution in a later render context viewed by another user or privileged operator. This Skill provides a structured hunting methodology with controlled two-account testing, harmless canaries, and explicit negative controls so findings are real, in-scope, and reportable. ## Core Features & Use Cases - Source-to-sink tracing: Map each user-controlled field from write endpoint through storage to every renderer, viewer role, origin, CSP, and required interaction. - Test recipes: Covers API/UI coverage mismatches, script-context names, upload content-type chains, error-but-stored behavior, Markdown/wiki parser mutation, and blind internal sinks. - Negative-control taxonomy: Applies 12 stop-condition categories (e.g., self-XSS, isolated origins, CSP blocks) so non-exploitable or out-of-scope results are never filed. - Version boundary table: OSV/GHSA data for DOMPurify, CKEditor, Quill, and other sanitizers filters out already-fixed vulnerable ranges. - Use Case: While testing a chat application, add a nested attachment field the UI does not expose containing an img onerror canary, then open the conversation with a second controlled account to confirm execution under the target origin. ## Quick Start Use the xss-stored-hunter skill to test whether user-controlled fields on my authorized bug-bounty target persist and execute as stored XSS for a second controlled viewer account.
