Skill UI

Guides systematic detection and exploitation of cross-site scripting and HTML injection flaws, covering stored/reflected/DOM vectors, payload crafting, and remediation advice for web security assessments.

Map web inputs for reflected or stored HTML injection, send crafted tags via URLs, POST bodies, or visible fields, and document appearance/phishing manipulations for authorized security assessments.

Runs AgentShield to audit Claude Code configuration files and MCP components for secrets, injection risks, and overly permissive settings, offering CLI, JSON/Markdown/HTML reports, auto-fix, Opus deep analysis, and CI-ready GitHub Action hooks to harden new or existing projects.

Assess web apps for client-side injection flaws, covering stored, reflected, and DOM XSS plus HTML injection, demonstrate session hijacking payloads, and guide validation and sanitization checks.

Guides systematic detection and exploitation of cross-site scripting and HTML injection flaws, covering stored/reflected/DOM vectors, payload crafting, and remediation advice for web security assessments.

Covers comprehensive HTML injection attack scenarios, detection tips, and tooling so security testers can validate and document injection points, phishing overlays, and reflected or stored payloads during vulnerability assessments.

A powerful technique used when full XSS is blocked by CSP, sanitizers, or WAFs, but HTML injection is possible. It leverages unclosed HTML tags (like <img> or <link>) to capture and exfiltrate sensitive page data (CSRF tokens, session IDs, form values) by forcing the browser to include the subsequent content in a request URL.

This router serves as the main entry point for comprehensive injection testing. It helps security professionals classify dangerous input flows—such as XSS, SQLi, SSRF, XXE, etc.—by determining the final sink or interpreter (e.g., browser context, database, XML parser, shell). Use it when unsure which specific injection vector to prioritize.

A comprehensive security skill designed to detect and mitigate indirect prompt injection attacks. It scans untrusted external content—including web pages, PDFs, and images—for hidden, obfuscated instructions before an LLM agent processes them. The pipeline combines content extraction (HTML, OCR), normalization, and dedicated ML models (e.g., LLM Guard, Prompt Guard 2) to ensure data safety.

This skill acts as a frontend security specialist to detect Cross-Site Scripting (XSS) vulnerabilities in React, Vue, Angular, and vanilla JavaScript code. It performs static analysis to identify unsafe DOM manipulation, improper sanitization, and injection points. The tool helps developers secure client-side applications by highlighting dangerous patterns like innerHTML usage, URL injection risks, and framework-specific security issues such as dangerouslySetInnerHTML or v-html directives. It provides severity ratings and remediation suggestions for CWE-79 vulnerabilities.

This skill enables identification and testing of HTML injection vulnerabilities in web applications to assess security risks. It involves using tools like Burp Suite and understanding HTTP structures. Strictly for authorized security assessments, defensive validation, or educational purposes in controlled environments.

This skill helps security researchers identify HTML injection vulnerabilities in web applications. It provides techniques for detecting unescaped user input, escalating to XSS, and proving impact with unique canaries. Recommended for authorized penetration testing and bug bounty engagements.