# Hunt Xss
> XSS hunting - reflected, stored, DOM-based. Marker discipline to avoid false positives. Blind-XSS beacons for stored contexts. SVG/markdown/redirect vectors. Wiki-first, FIND schema output.
- Skill: `encod3d-sec/hunt-xss` (Agent Skill)
- Install (CLI): `npx skillmds@latest add encod3d-sec/hunt-xss`
- Raw SKILL.md: https://api.skillmd.com/api/skills/encod3d-sec/hunt-xss/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Encod3d-Sec (https://skillmd.com/u/encod3d-sec)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/encod3d-sec/hunt-xss
---
# Hunt: XSS
**Assumes `hunt-core`** for the scope gate, two-account rule, confirmation gate, enumeration
limits, stop conditions, wiki protocol, FIND output, and Deadends. Marker discipline (unique 8+
char canaries, check the baseline first) lives in hunt-core.
## Wiki
```
qmd_query "XSS cross-site scripting DOM CSP bypass sanitizer" via wiki-search MCP
```
Hub: [[web-moc]] (live web index). Primary page: [[xss]]. Payload arsenals: `wiki/payloads/{xss,prototype-pollution}.md`.
Related client-side vectors: [[dangling-markup]] (scriptless HTML-injection exfil when script tags
are blocked), [[xssi]] (JSONP/script-inclusion info leak), [[browser-extension-attacks]]
(content-script/message-passing injection).
## Confirmation gate
NOT confirmation: payload URL-encoded or HTML-encoded in response, `