What problem does it solve? Static scanners flag XSS candidates but cannot prove they are actually exploitable, leaving teams buried in false positives. This Skill dynamically confirms reflected, stored, and DOM XSS vulnerabilities by injecting unique marker payloads into candidate parameters and verifying real script execution in a browser. ## Core Features & Use Cases - HTTP Reflection Testing: The attack_xss.py script injects seven context-specific payloads (HTML body, attribute breakout, JS inline escape) and classifies where markers reflect unescaped in the response. - Browser Execution Confirmation: Playwright MCP workflows navigate pages, submit payloads, and read window.__xss_fired to definitively confirm script execution, with screenshot and console-log evidence capture. - Fail-Closed Safety Gate: scope_guard.py blocks production and public targets at the code level, allowing only authorized local/staging environments. - Use Case: After a static scan flags an unescaped ${param.q} in a JSP search page, run this Skill against the local staging server to inject a marker payload, confirm execution in a browser, and produce a four-element report (vulnerable point, cause, exploit path, fix) with evidence. ## Quick Start Run the XSS exploitation skill against http://localhost:8080/search with parameter q to confirm whether the reflected XSS candidate is actually exploitable.
