# Cross-Site Scripting (XSS) Detection

> Detects DOM-based Cross-Site Scripting (XSS) vulnerabilities in JavaScript

- Skill: `zakirkun/cross-site-scripting-xss-detection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/cross-site-scripting-xss-detection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/cross-site-scripting-xss-detection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/cross-site-scripting-xss-detection

---


# Cross-Site Scripting (XSS)

## Overview
XSS vulnerabilities occur when an application includes untrusted data in a web page without proper validation or escaping.

## Detection Strategy
This SKILL specifically looks for dangerous DOM manipulations in frontend code where user-controlled input might be executed as script.

Sinks:
- `innerHTML` assignment
- `document.write()`
- `eval()`
- `setTimeout()` with string evaluation

## Remediation
Use safer alternatives like `textContent` or `innerText` instead of `innerHTML`. Use DOMPurify if HTML insertion is strictly required.