[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvw36rqawm66k":3},{"code":4,"message":5,"data":6,"timestamp":24},10000,"success",{"full_name":7,"position":8,"stars_gained":8,"description":9,"language":10,"stars":11,"forks":12,"age_days":13,"hn_threads":14,"one_liner":15,"summary_md":16,"topic":17,"github_topics":20,"license":21,"homepage":10,"updated_at":22,"history":23},"songjianyang\u002Fxss-audit",0,"Static XSS audit skill with 14 layers of checks for React, TypeScript, and JavaScript projects.",null,339,100,1,[],"A static XSS audit checklist for React\u002FTypeScript\u002FJavaScript projects, packaged as an agent skill for developers and security reviewers.","This is worth a look if you already have an agent workflow and want a structured static XSS review checklist to run against a React\u002FTypeScript\u002FJavaScript codebase. It is a skill, not a scanner: installation means copying the skill file into your agent's skills directory, and the output is a Markdown report you still have to read and verify.\n\n## The problem\n\nA developer or security reviewer wants to sweep a frontend codebase for XSS before release or during a bug-bounty pass. Typically they search for `innerHTML`, `dangerouslySetInnerHTML`, `href`, `postMessage` and similar sinks by hand, then trace each match back to a source and decide whether validation exists. That process is slow and easy to cut short. This skill changes the step after the search: it gives the reviewing agent 14 layers of check prompts and a report format with source, sink, data flow and a fix suggestion, so the human gets a structured list to verify instead of raw grep hits. The result is a review document, not a confirmed vulnerability list.\n\n## What's different\n\nThe breadth of the checklist is the main draw. It goes past DOM sinks into attributes and event handlers, URL and navigation validation, SSR bootstrap and JSON-LD script breakout, prop spreading, `postMessage` origin checks, prototype-pollution chains, `eval`\u002F`Function`\u002FBlob execution, CSS injection, SVG\u002FMathML namespaces, markdown and sanitizer\u002FmXSS handling, framework trust hooks such as Vue `v-html` and Lit `unsafeHTML`, Trusted Types\u002FCSP, and framework binding\u002Ftemplate-injection paths. The README frames this as distilled from the author's bug-bounty work and cites four consecutive quarterly Top-10 placements on Microsoft's MSRC researcher leaderboard for 2025 Q3 through 2026 Q2 ([leaderboard](https:\u002F\u002Fmsrc.microsoft.com\u002Fleaderboard), [profile](https:\u002F\u002Fx.com\u002FSecBoxer)). That is a credibility signal about the author's process, not independent evidence that the skill finds every issue.\n\nThe output design is where the trade-off shows. Each finding must document location, source\u002Fsink\u002Fdata flow, vulnerable code, a fix, confidence and verification status, and reproduction notes that separate theoretical steps from executed ones. There is a separate manual-review section for incomplete data flows, and a per-layer search summary that distinguishes pattern matches from confirmed vulnerabilities ([sample report](https:\u002F\u002Fgithub.com\u002Fsongjianyang\u002Fxss-audit\u002Fblob\u002Fmain\u002Fexamples\u002Fsample-report.md)). That structure is useful for triage, but it also means the tool is honest about doing only static analysis. The README explicitly says a search match is not a confirmed vulnerability, and warns about false positives and false negatives from runtime behavior, build-time transforms, excluded code and framework timing. You should budget time for the verification pass; the report is a starting point for human review.\n\n## Who should try it\n\nGood fit: a frontend or application-security engineer who already uses a coding agent with a skills mechanism, wants a repeatable XSS checklist for React\u002FTypeScript\u002FJavaScript repos, and is willing to verify findings manually. It is also a reasonable fit for a bug-bounty hunter who wants to compare their own review process against a broader set of sinks.\n\nPoor fit: anyone expecting a CI scanner that blocks merges or produces a definitive vulnerability count. The README gives no automated test harness, no dependency install and no runtime checks, and it explicitly says no coverage is guaranteed. If your codebase is mostly server-rendered in another language, or you need dynamic proof-of-concept execution, this skill's layer list is not aimed at that.\n\n## Requirements and limitations\n\nThe setup is minimal: copy `xss-audit\u002FSKILL.md` into your agent's skills directory and invoke `\u002Fxss-audit` or `\u002Fxss-audit src\u002F` ([project README](https:\u002F\u002Fgithub.com\u002Fsongjianyang\u002Fxss-audit\u002Fblob\u002Fmain\u002FREADME.md), [SKILL.md](https:\u002F\u002Fgithub.com\u002Fsongjianyang\u002Fxss-audit\u002Fblob\u002Fmain\u002FSKILL.md)). There is no package manager step or service to run, but you do need an agent that supports skill files; without that, the checklist is just reading material.\n\nThe larger constraint is the static-only scope. Findings need manual confirmation, and the report may include sensitive paths, source code, internal domains or credentials, so it should be reviewed and sanitized before sharing. The license is MIT ([license](https:\u002F\u002Fgithub.com\u002Fsongjianyang\u002Fxss-audit\u002Fblob\u002Fmain\u002FLICENSE)), so adapting the checklist to your own review process is straightforward. The README does not document per-project configuration beyond the target path argument, so expect to adapt the layer descriptions to your framework mix.\n\n## HotRepo's take\n\nHotRepo first tracked this repository on 2026-10-24, and by 2026-10-25 it had 339 total stars and ranked #20 on the NEW-REPOSITORY board (新项目榜, all languages) ([repository](https:\u002F\u002Fgithub.com\u002Fsongjianyang\u002Fxss-audit)). That is one dated snapshot, not a growth series; persistence cannot be judged from it. As an adoption decision, the useful next check is whether the 14 layers map onto your actual stack, especially if you rely on a framework not covered in the trust-hook list, before you invest in running it.",{"slug":18,"name":19},"security","Security & Privacy",[],"MIT","2026-10-25T12:46:18Z",[],1792969105]