XSS Hunting is a Quality skill for Claude Code, published by H-mmer in pentest-agents.
XSS Hunting finds DOM, stored, reflected, postMessage, and mutation-based XSS paths, including sanitizer bypasses and modern framework rendering issues. Use it when testing web apps, markdown renderers, OAuth flows, or message handlers for injection.
XSS Hunting is cataloged under Quality on DirSkills. XSS Hunting comes from a repository tagged agents, bug-bounty, bugcrowd, claude-code and hackerone.
Documentation
XSS is the highest-frequency web bug class but the modern paying surface has shifted. Reflected XSS on a public marketing page is mid four-figure at best; stored XSS chained to admin ATO is mid five-figure; mXSS bypass of a popular sanitizer pays direct from Cure53/Snyk plus downstream chains. The 24-month meta has crystallized around six asset types. All CVEs below are NVD-verified.
This is the opening of the README. Read the full README on GitHub.
XSS Hunting is one of 25 skills that DirSkills catalogs from H-mmer/pentest-agents, the repository it ships in. Its siblings there include Analyze, Autopilot and Brain. Each one is a separate skill with its own page in this directory, installs the same way XSS Hunting does, and is maintained by H-mmer in that same repository. The rest of the collection is listed on the H-mmer/pentest-agents page.
XSS Hunting ranks #971 by stars among the 1354 Quality skills in this catalog. The most-starred ones next to it are Benchmark, Benchmark Optimization Loop and API Design Patterns. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of XSS Hunting against them. Open each page to compare what they document and how they install.
XSS Hunting is one of 25 skills cataloged on DirSkills from H-mmer/pentest-agents.
XSS Hunting is one of 1354 Quality skills cataloged on DirSkills, ranked #971 by stars among them.