Kennyalfredo

Hunt XSS — Testing skill for Claude Code

Testing community

Active XSS hunt for an ingested program.

How to install Hunt XSS

Installs to ~/.claude/commands/kennyalfredo-pr-agent-hunt-xss.md

Terminal

mkdir -p ~/.claude/commands && curl -fsSL https://raw.githubusercontent.com/Kennyalfredo/pr-agent/HEAD/.claude/commands/hunt-xss.md -o ~/.claude/commands/kennyalfredo-pr-agent-hunt-xss.md

Restart Claude Code, or start a new session, for it to be picked up.

What Hunt XSS does

description: Active XSS hunt for an ingested program. Consumes webvuln-surface seeds (reflected params + DOM sinks) + optional auth-context, tests each injection point via Burp + Playwright using context-aware payloads. Confirms reflected/stored/DOM XSS to the proof ceiling (alert(document.domain) in own session — never stored XSS for other users, never cookie exfil). Writes redacted candidates; does not verify ownership or draft. argument-hint: allowed-tools: Agent

You a

Alternatives in Testing

Crlf — Test for CRLF / HTTP response-splitting and host-header injection — Set-Cookie injection, cache poisoning, res 4.5k ★
Design QA — Visual QA on an HTML/CSS implementation — checks responsive behavior at mobile/tablet/desktop, design token co 309 ★
Test After Change Diagnostics.V1 — If any program code changes, run unit-tests and follow up on the test-result (fix code if there is an error) 272 ★