hunt-xss SKILL.md skillA
hunt-xss from galact-byte/galact-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add galact-byte/galact-skills/hunt-xss@git:20260806.9a36820Pins git:20260806.9a36820 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- galact-byte/galact-skills
- Path
skills/hunt-xss/SKILL.md- Versions recorded
- 2
- Latest version
- git:20260806.9a36820, committed Aug 6, 2026
- First version recorded
- Aug 6, 2026
- Size
- 4,183 bytes
- Repository stars
- 7
- License
- a license file GitHub does not identify
在授权渗透测试中挖掘跨站脚本（XSS：反射型、存储型、DOM 型，含 WAF/CSP 绕过与 sink 分析）。当目标把用户输入回显到 HTML/JS/属性/URL 上下文、或前端把可控数据喂给危险 sink（innerHTML/eval/srcdoc）时使用——典型场景：搜索/评论/标题回显、SVG/上传、postMessage、javascript:URL 伪协议、模板属性注入、绕 CSP。适用目标类型 Web 前端 / REST API。触发场景包括用户说"测下 XSS""这个参数会不会弹窗""能绕 CSP/WAF 吗""DOM XSS/存储型看一下"。输出：XSS 触发点 + 上下文 + PoC 的 finding（含 killed 记录）。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# hunt-xss · 跨站脚本猎杀
只解决 **XSS 一类**：反射/存储/DOM。核心是"输入回显在什么上下文（HTML body / 属性 / JS / URL / SVG）"决定 payload 形态，先用**唯一标记**探反射与编码强度，再按上下文构造可执行 PoC，必要时绕 WAF/CSP。判定靠**标记未编码进入可执行上下文**。
XSS PoC 只用**无害标记/`alert(document.domain)`** 证明执行，不投放窃密/蠕虫脚本，不打真实用户。上下文 payload、绕过技巧、真实报告见 `reference.md`。
## Scope（授权范围）
**先确认授权。** 存储型会持久化到页面，影响其他用户。
落实：授权目标、允许存储型（会留痕，需能清理）、允许触碰的页面、PoC 仅用无害标记。任一不清楚就停下问。
## Goal
判定用户输入能否在浏览器上下文执行脚本，给出上下文、可复现 PoC（`alert(document.domain)` 级）与影响（会话窃取/钓鱼/蠕虫的可达性），留存反射/执行证据。
## Workflow
`scope-check → recon → hunt → validate → report`。
### 1. scope-check
- **动作**：写 `evidence/scope.txt`（allow_stored）。
- **命令**：`bash tools/recon.sh <target> --scope-only`。
- **终止条件**：scope 明确，否则 KILL。
### 2. recon
- **动作**：枚举回显参数、搜索/评论/标题字段、上传（SVG/HTML）、URL 片段消费的前端 sink（`location.hash`→`innerHTML`）、postMessage 监听。
- **输出**：`recon/endpoints.json`。
- **命令**：`bash tools/recon.sh <target>`。
- **终止条件**：至少 1 个回显/ sink 入口。
### 3. hunt
- **动作**：对每个入口注入**唯一标记**（如 `hxss9f3a2b`）+ 一组上下文探针（裸文本、`"`、`'`、`<`、`</script>`、`{{7*7}}`），抓响应看标记落在哪个上下文、哪些字符被编码。据此判定可执行上下文。
- **输出**：`candidates.json`（每入口：上下文、未编码字符、疑似可执行）。
- **命令**：`python tools/hunt_xss.py --input recon/endpoints.json --output candidates.json`。
…Read the whole file at its exact version.
How to install
mdr add galact-byte/galact-skills/hunt-xss@sha256:182c6602f6ce8d7bThe line at the top of this page pins the label git:20260806.9a36820, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_puqgph6thtnkk3ne)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, all committed on Aug 6, 2026.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260806.9a36820 latest | 2026-08-06 | 9a36820 | 4,183 B | A | view · diff |
| git:20260806.1b94651 | 2026-08-06 | 1b94651 | 4,174 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4183 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
galact-byte/galact-skills · 7 stars · license a license file GitHub does not identify · pushed 2026-10-12 · branch master
API
GET https://markdownregistry.com/api/v1/artifacts/art_puqgph6thtnkk3ne GET https://markdownregistry.com/api/v1/resolve?ref=galact-byte/galact-skills/hunt-xss GET https://markdownregistry.com/api/v1/blob/182c6602f6ce8d7b13a294c75aa6f4c47398faf43772095c4f6b1d26ef3da275
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from galact-byte/galact-skills
Every file in galact-byte/galact-skills