React/TypeScript/JavaScript codebases (정적 감사)를 위한 체크 14개의 층을 가진 포괄적인 XSS 취약점 탐지 기술. 사용자는 SVG, MathML, CSS 주입, Markdown 파이프라인, mXSS/sanitizer 바이패스, JSON-in-script 주입, URL 유효성 검사, Trusted Types 분석 등 광범위한 정적 적용으로 심층 XSS 감사를 원할 때 사용합니다. xs-audit-report.md에 대한 출력 보고서.

정적 분석만. 검색 일치는 확인 취약점이 아닙니다.

배경

이 기술은 실제 버그 bounty에서 내 손을 작업에서 온다 프로그램 1 년 동안, 나는 내 일에 그것을 사용 감사 워크플로우와 세련 된 일 그리고 무엇을 놓았다. 그 워크플로는 XSS의 수십 가지를 식별할 수 있었습니다. bounties를 수여 한 취약점.

같은 기간 동안, 나는 Microsoft의 MSRC 보안에 순위 Researcher Leaderboard (분기 상위 10위) 분기 — 2025 Q3 #4, Q4 #7, 2026 Q1 #6, Q2 #10 (리더보드, 내 프로필).

나는 그것을 공유합니다 그래서 다른 사람은 동일한 검토 과정을 적응시킬 수 있습니다 그들의 자신의 감사.

설치

이 디렉토리를 에이전트의 기술 디렉토리에 복사:

사용법

xss-audit

Comprehensive XSS vulnerability detection skill with 14 layers of checks for React/TypeScript/JavaScript codebases (static audit). Use when the user wants an in-depth XSS audit with broad static coverage, including SVG, MathML, CSS injection, markdown pipelines, mXSS/sanitizer bypass, JSON-in-script injection, URL validation bypass, and Trusted Types analysis. Outputs report to xss-audit-report.md.

Static analysis only. A search match is not a confirmed vulnerability.

Background

This skill comes from my hands-on work in real-world bug bounty programs. Over the course of one year, I used it in my day-to-day audit workflow and refined it continuously based on what worked and what missed. That workflow helped me identify dozens of XSS vulnerabilities that were awarded bounties.

During the same period, I was ranked in Microsoft’s MSRC Security Researcher Leaderboard (quarterly Top 10) for four consecutive quarters — 2025 Q3 #4, Q4 #7, 2026 Q1 #6, Q2 #10 (leaderboard, my profile).

I’m sharing it so others can adapt the same review process to their own audits.

Installation

Copy this directory into your agent’s skills directory:

/xss-audit/SKILL.md

Usage

/xss-audit
/xss-audit src/

Or use $ if that is your agent’s skill syntax:

$xss-audit
$xss-audit src/

What it checks

The 14 review layers cover:

1. DOM and HTML injection: innerHTML, outerHTML, insertAdjacentHTML, document.write, DOMParser, setHTMLUnsafe, shadow DOM, and React dangerouslySetInnerHTML.
2. Attributes and event handlers: dynamic on* handlers, href, src, srcdoc, action, formaction, style, and JSX props that forward attacker-controlled values.
3. URLs and navigation: window.open, location, router navigation, protocol allowlists, hostname and substring validation errors, parser normalization, and downstream use of History API state.
4. Configuration and JSON-in-script: SSR bootstrap data, hydration state, JSON-LD, rich-text configuration, and `` breakout caused by unsafe serialization.
5. Props spreading and gadget components: untrusted props forwarded to anchors, iframes, URL-handling components, and dynamic attributes.
6. Untrusted sources and messaging: URL data, API responses, cookies, storage, IndexedDB, referrer, postMessage, BroadcastChannel, and MessageChannel, including origin, source, schema, and target-origin checks.
7. Prototype pollution chains: unsafe merge, setter, and assignment paths that can influence a security-sensitive XSS gadget.
8. JavaScript execution: eval, new Function, string timers, dynamically created scripts, Blob/ObjectURL execution, and worker script imports.
9. CSS and style injection: cssText, setProperty, insertRule, CSS-in-JS interpolation, external CSS URLs, and legacy browser-specific execution mechanisms where relevant.