{"enrichment":{"faq":[{"a":"xss-prevention teaches you to defend against cross-site scripting by combining multiple defensive layers. The primary approach is implementing sanitization to remove malicious code from user input, paired with output encoding that escapes special characters based on context (HTML, attributes, URLs, or JavaScript). For dynamic content, use allowlist-based filtering to permit only safe HTML tags and attributes. Additionally, configure Content Security Policy (CSP) headers to block inline script execution and restrict script sources, creating a robust barrier against script injection attacks.","q":"How do I prevent XSS attacks in web apps?"},{"a":"xss-prevention emphasizes that sanitization must be context-aware and combined with output encoding. Best practices include: using established libraries like DOMPurify for allowlist-based HTML filtering rather than blacklists; applying context-specific encoding (HTML entities for text content, URL encoding for links, JavaScript escaping for event handlers); avoiding dangerous DOM APIs like innerHTML in favor of safer alternatives such as textContent or createElement; and validating input on both client and server sides. Never rely on sanitization alone\u2014layer it with CSP headers and secure coding patterns to create defense in depth.","q":"What are XSS prevention sanitization best practices?"},{"a":"xss-prevention equips you with practical techniques across the full attack surface. Learn to identify and eliminate vulnerable patterns like direct innerHTML assignment, eval() usage, and unsafe event handler binding. Master safe DOM manipulation by using APIs that treat content as text rather than markup. Implement allowlist-based filtering for user-generated content in rich text editors. Configure CSP headers with appropriate nonce values to prevent inline script execution. The skill covers both reflected and stored XSS prevention, ensuring you can secure data at every stage\u2014from input validation through storage and final rendering.","q":"How can xss-prevention help me stop cross-site scripting vulnerabilities?"},{"a":"xss-prevention teaches that DOMPurify is an allowlist-based sanitization library that removes dangerous HTML and JavaScript while preserving safe markup. When handling user-generated content\u2014especially in rich text editors or comment systems\u2014DOMPurify filters input against a whitelist of permitted tags and attributes, stripping any script tags, event handlers, or protocol-based URLs that could execute malicious code. This sanitization step is essential for securing user-generated content, but xss-prevention emphasizes it must be paired with output encoding and CSP headers for complete protection against injection attacks.","q":"What is the relationship between DOMPurify sanitization and preventing user input attacks?"},{"a":"xss-prevention covers CSP configuration as a critical defense layer that blocks inline scripts and restricts script sources at the browser level. Configure headers like `Content-Security-Policy: script-src 'self'` to allow scripts only from your domain, or use nonce-based CSP (`script-src 'nonce-{random}'`) to permit only inline scripts with a matching nonce attribute, preventing attackers from injecting arbitrary scripts. You can also add `default-src 'self'` to restrict all resource loading. xss-prevention teaches you to implement CSP progressively, starting in report-only mode to identify legitimate script usage before enforcing strict policies that block malicious script execution.","q":"How do I set up Content Security Policy headers to block malicious script execution?"},{"a":"xss-prevention teaches that innerHTML parses and executes any script tags in the input, making it vulnerable to DOM-based XSS. Safe alternatives include textContent for plain text content (which treats all input as literal text), createElement() and appendChild() for programmatic DOM construction, and template literals with proper encoding. For dynamic HTML that must be rendered, combine these safe APIs with sanitization libraries like DOMPurify. The skill emphasizes learning secure DOM manipulation patterns so you avoid vulnerable APIs entirely, reducing your attack surface and ensuring that user-controlled data cannot be interpreted as executable code.","q":"What safe DOM APIs should I use instead of innerHTML to prevent DOM-based XSS attacks?"}],"shadow_tags":["attack-mitigation","input-defense","browser-security","payload-filtering","html-escaping","policy-enforcement","vulnerability-patching","secure-rendering"],"summary_rewrite":"This skill equips developers with practical techniques to defend against cross-site scripting (XSS) vulnerabilities through input sanitization and secure output encoding. Master the core defensive patterns needed to protect web applications from malicious script injection and ensure safe handling of untrusted data across your codebase."},"files":[{"bytes":6054,"path":"plugins/xss-prevention/skills/xss-prevention/SKILL.md","sha256":"dba321ea23e8a18ef4d0c647f028a79186d18494ed0ed4f9890df8e4ac08b283","url":"https://skillfed.io/files/secondsky/claude-skills/xss-prevention/72191727/SKILL.md"}],"id":"secondsky/claude-skills/xss-prevention","links":{"html":"https://skillfed.io/secondsky/claude-skills/xss-prevention","md":"https://skillfed.io/secondsky/claude-skills/xss-prevention.md","repo":"https://github.com/secondsky/claude-skills"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":29,"language":"TypeScript","last_updated":"2026-07-25","license":"MIT","name":"xss-prevention","publisher":"secondsky","stars":196},"relations":{"similar":[{"id":"aj-geddes/useful-ai-prompts/xss-prevention"},{"id":"utkusen/sast-skills/sast-xss"},{"id":"martinholovsky/claude-skills-generator/vue-nuxt"},{"id":"Bbeierle12/Skill-MCP-Claude/form-security"},{"id":"H-mmer/pentest-agents/hunt-xss"},{"id":"H-mmer/pentest-agents/pentest-agents-hunt-xss"},{"id":"organvm/a-i--skills/security-implementation-guide"},{"id":"addyosmani/web-quality-skills/best-practices"},{"id":"oracle/netsuite-suitecloud-sdk/netsuite-owasp-secure-coding"},{"id":"jim60105/copilot-prompt/typescript-security"}]},"slug":{"owner":"secondsky","repo":"claude-skills","skill":"xss-prevention"},"version":"72191727"}