Skip to content
Get packs

Cross-Site Scripting Testing Checklist

Walks an agent through a structured XSS testing methodology for web apps and bug bounties

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

When active, this skill gives the agent a step-by-step checklist for finding cross-site scripting (XSS) flaws in web applications: where user input is stored or reflected, which payloads to try, how to confirm they run in a browser, how to work around common filters and Content Security Policy, and how to judge the impact. It is a methodology and reference, not a tool that attacks anything by itself. Its content is mostly explanations and example payloads, and it does not include scripts for the agent to run.

Great for

  • Security testers and bug bounty hunters who want a structured XSS checklist
  • Developers or AppSec engineers reviewing their own application for XSS before release
  • Students learning how stored, reflected, DOM and blind XSS differ

Skip it if

  • Testing websites you do not own or have written permission to test, since using it against third-party systems may be illegal and violates most bug bounty rules
  • Users with no security background who expect a one-click scanner; the skill is a checklist that still needs human judgement and a browser or test environment

Try asking

  • “Use the XSS skill to build a checklist for testing the search and comment fields on my staging site”
  • “Explain the difference between stored and DOM XSS with examples from my app's code”
  • “Walk me through CSP bypass ideas for a login page I am authorised to test”
Step-by-step guide: how to use Cross-Site Scripting Testing ChecklistInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-xss.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-xss.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-xss.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use it on systems you own or are explicitly authorised to test, and keep a written scope.
  • Give the agent concrete context such as the framework, endpoints and the parts of the app in scope so it can tailor the checklist.
  • Use it to plan and reason about tests; verify payloads yourself in a controlled staging environment.

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.