Awarexone

Domxss — Development skill for Claude Code

Development community

Confirm DOM XSS in a real headless browser — injects canary payloads into params + URL fragment and only reports when the browser actually executes them.

How to install Domxss

Installs to ~/.claude/skills/awarexone-agentic-bug-hunter-domxss/SKILL.md

Terminal

mkdir -p ~/.claude/skills/awarexone-agentic-bug-hunter-domxss && curl -fsSL https://raw.githubusercontent.com/Awarexone/Agentic-Bug-Hunter/HEAD/commands/domxss.md -o ~/.claude/skills/awarexone-agentic-bug-hunter-domxss/SKILL.md

Restart Claude Code, or start a new session, for it to be picked up.

What Domxss does

description: Confirm DOM XSS in a real headless browser — injects canary payloads into params + URL fragment and only reports when the browser actually executes them. Usage: /domxss "" [--params q,name] [--shot out.png]

/domxss

Reflected-XSS scanners see a payload echoed back in HTML but can't tell whether it *ran* — CSP, framework auto-escaping, or a sink that never reaches `eval`/`innerHTML` all silently kill it. This drives headless Chromium, fires a uniquely-tagged payload t

Alternatives in Development

Distribb Setup — Set up Distribb - check API key, confirm website + GSC are connected, enable the slash commands 195 ★
Openshell Deepagent — A general-purpose coding agent that runs inside an NVIDIA OpenShell sandbox, orchestrated by Deep Agents and p 187 ★
Wos Dom — WoS (Web of Science) DOM & URL Reference 111 ★