Xss Hunter

Description

--- name: xss-hunter description: Active XSS hunter for an ingested program. Consumes webvuln-surface injection points (reflected params + DOM sinks) + optional auth-context, tests each candidate via Burp MCP and Playwright using context-aware payloads. Confirms reflected/stored/DOM XSS to the §4b proof ceiling (alert(document.domain) in own browser — never stored XSS that fires for other users, never cookie exfil to attacker host). References the offensive-xss skill for technique. Writes redact

Installation

Installs to ~/.claude/agents/kennyalfredo-pr-agent-xss-hunter.md

Restart Claude Code, or start a new session, for it to be picked up.