GitHub radar
Find XSS vulnerabilities in your code before you ship
xss-audit is a skill for your coding agent (like Claude Code) that hunts for XSS vulnerabilities in your code. Once installed, your agent scans the project itself and writes up a report of what it found and how to fix it.
It's a 14-point checklist for XSS — ways user input can sneak into HTML, SVG, CSS, or scripts in your React/TypeScript/JavaScript project.
When it helps
Useful as a final check before deploying a site or app you built with a coding agent. Skip it if your project isn't web-facing or uses other languages.
Pros
- Covers 14 XSS attack types, including SVG, CSS, and sanitizer bypass
- Built by a bug bounty hunter who found paid bugs with it for a year
- Logs each finding with location, confidence level, and a fix
- Runs inside the agent you already use — no separate install needed
Cons
- Static analysis only — no code execution, so false positives happen
- Every finding needs manual review before you touch the code
How to set it up — step by step
- 1Open your coding agent (like Claude Code) in the project folder you want to check.
- 2Send the agent the text from the block below.
- 3Approve file access if the agent asks for it.
- 4Wait for the scan to finish and ask the agent to show the xss-audit-report.md report.
- 5Manually verify each finding before making any code changes.
Text for your agent
Copy this and send it to your agent — Claude Code, Codex, any of them:
Download the xss-audit skill from https://github.com/songjianyang/xss-audit — copy its folder into my coding agent's skills directory, run the audit with the /xss-audit command on the current project, and show me the resulting xss-audit-report.md report at the end. Ask me if you need any permissions.
This is a text skill for an agent, not a separate program: it needs no dedicated hardware and runs inside whatever agent you already use, Claude Code or similar. All it needs is access to the project files you are checking.
Open on GitHub▌ More finds