How do I install the Client Side skill?

Run npx skillmds add transilienceai/client-side in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Client Side skill do?

Client-side vulnerability testing - XSS (reflected/stored/DOM), CSRF, CORS misconfiguration, Clickjacking, DOM-based attacks, and Prototype Pollution. It is listed under Security on SkillMD.

Is Client Side safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Client Side?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Client Side free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Client Side?

transilienceai (@transilienceai) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Client Side by transilienceai — Agent Skill

Name: Client Side
Rating: 4.2 (5 reviews)
Author: transilienceai

File contents

Client-Side

Test for client-side vulnerabilities across modern web applications and SPAs.

Techniques

Type	Key Vectors
XSS	Reflected, Stored, DOM-based, framework-specific (React, Vue, Angular)
CSRF	Token bypass, SameSite cookie bypass, cross-origin requests
CORS	Misconfigured origins, null origin, wildcard credentials
Clickjacking	Frame-based, drag-and-drop, multi-step
DOM-based	DOM sinks, source/sink analysis, JavaScript URL schemes
Prototype Pollution	Client-side gadgets, server-side pollution, property injection

Workflow

Identify input sources and data flows
Classify sink contexts (HTML, attribute, URL, JS, CSS)
Enumerate defenses (encoding, CSP, sanitizers, Trusted Types)
Craft context-appropriate payloads
Validate execution and demonstrate impact
Document with reproduction steps and remediation

Reference

reference/xss*.md - XSS bypass techniques and exploitation
reference/csrf*.md - CSRF techniques and bypasses
reference/cors*.md - CORS misconfiguration testing
reference/clickjacking*.md - Clickjacking techniques
reference/dom*.md - DOM-based vulnerability testing
reference/prototype-pollution*.md - Prototype pollution techniques

Frequently asked questions