A security skill that walks your agent through 14 layers of cross-site scripting checks on React, TypeScript and JavaScript code, from innerHTML and unsafe links to Markdown sanitizers and postMessage, and writes the findings to a report.
In short: A security skill that walks your agent through 14 layers of cross-site scripting checks on React, TypeScript and JavaScript code, from innerHTML and unsafe links to Markdown sanitizers and postMessage, and writes the findings to a report. It is a free skill for people who use Claude Code or Codex and want help with coding agent skills.
Checked on · Added
| Agent / tool | Access / cost | Link |
|---|---|---|
| Claude Code | Paid Claude plan or API | claude.com/claude-code |
| Codex | ChatGPT plan or API | openai.com/codex |
| GitHub repo | Open source · ★ 526 | songjianyang/xss-audit |
git clone https://github.com/songjianyang/xss-audit ~/.claude/skills/xss-audit /xss-audit src/
Install command copied from the project README. Check the README for the latest version.
A security skill that walks your agent through 14 layers of cross-site scripting checks on React, TypeScript and JavaScript code, from innerHTML and unsafe links to Markdown sanitizers and postMessage, and writes the findings to a report.
xss-audit gives your coding agent a step-by-step cross-site scripting review for front-end code. It walks 14 layers: raw HTML sinks and dangerouslySetInnerHTML, risky attributes and event handlers, URL and redirect…
Short excerpt from the README of songjianyang/xss-audit. Read the full README on GitHub.
Written by us so you can reuse it. Replace each [bracket] with your details.
Static reading only: a match is a lead, not a confirmed bug, and it never runs exploits. Only test sites and code you own or are allowed to audit. Built by a bug-bounty researcher from his own workflow; pairs with Cloudflare's broader security-audit skill, which covers more than XSS.
A security skill that walks your agent through 14 layers of cross-site scripting checks on React, TypeScript and JavaScript code, from innerHTML and unsafe links to Markdown sanitizers and postMessage, and writes the findings to a report.
It works with Claude Code and Codex. The code is on GitHub at songjianyang/xss-audit.
Free & open source (MIT). One SKILL.md, no install script, no API key.
Run the install command from the README: “git clone https://github.com/songjianyang/xss-audit ~/.claude/skills/xss-audit”. Check the README on GitHub for the latest version, then follow the steps on this page.
We read 4 instruction and code files in the repo and found no red flags. That is not a guarantee, so review anything that runs commands on your machine.
All credit to the original authors. We rewrite in our own words and link back. Something wrong? Report it.
SKILLYour coding agent connects to an Android or Google TV over Wi-Fi, switches off the ad and tracking apps, and puts in a clean, Apple TV-style home screen. Nothing is uninstalled.
Claude Code +2★ 14.8k
SKILLA Claude skill that reviews a vibecoded screen like a designer: it lists the tell-tale AI touches, proposes a direction from your own product, then fixes spacing, colour, icons, copy, type and layout pass by pass. Works on dashboards, apps, landing pages, or a live site from a link.
Claude Code★ 540
SKILLOne install gives your agent a plan, test, build, review and remember routine, with 71 helper agents, about 300 skills, memory between sessions and a built-in scanner for risky agent settings.
Claude Code +3★ 285.3k
SKILLA skills framework that makes agents brainstorm, plan, test and debug systematically.
Claude Code +1★ 299.2k
SKILLReal engineering skills from a well-known TypeScript educator's own .agents folder.
Claude Code +1★ 291.4k
SKILLA skill that pushes coding agents to act like a lazy senior: fewer lines, more tests, lower cost — without skipping the hard checks.
Claude Code +2★ 164.8kFree newsletter
New AI tools you can use right away, in plain words. Every Friday.