xss-prevention
This skill equips developers with practical techniques to defend against cross-site scripting (XSS) vulnerabilities through input sanitization and secure output encoding. Master the core defensive patterns needed to protect web applications from malicious script injection and ensure safe handling of untrusted data across your codebase.
xss-prevention teaches you to defend against cross-site scripting by combining multiple defensive layers. The primary approach is implementing sanitization to remove malicious code from user input, paired with output encoding that escapes special characters based on context (HTML, attributes, URLs, or JavaScript). For dynamic content, use allowlist-based filtering to permit only safe HTML tags and attributes. Additionally, configure Content Security Policy (CSP) headers to block inline script execution and restrict script sources, creating a robust barrier against script injection attacks.
AI-generated summary based on this skill's SKILL.md
Install
secondsky/claude-skills/xss-prevention · repository language: TypeScript
git clone https://github.com/secondsky/claude-skills
cp -r claude-skills/plugins/xss-prevention/skills/xss-prevention ~/.claude/skills/xss-preventionFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I prevent XSS attacks in web apps?
xss-prevention teaches you to defend against cross-site scripting by combining multiple defensive layers. The primary approach is implementing sanitization to remove malicious code from user input, paired with output encoding that escapes special characters based on context (HTML, attributes, URLs, or JavaScript). For dynamic content, use allowlist-based filtering to permit only safe HTML tags and attributes. Additionally, configure Content Security Policy (CSP) headers to block inline script execution and restrict script sources, creating a robust barrier against script injection attacks.
What are XSS prevention sanitization best practices?
xss-prevention emphasizes that sanitization must be context-aware and combined with output encoding. Best practices include: using established libraries like DOMPurify for allowlist-based HTML filtering rather than blacklists; applying context-specific encoding (HTML entities for text content, URL encoding for links, JavaScript escaping for event handlers); avoiding dangerous DOM APIs like innerHTML in favor of safer alternatives such as textContent or createElement; and validating input on both client and server sides. Never rely on sanitization alone—layer it with CSP headers and secure coding patterns to create defense in depth.
How can xss-prevention help me stop cross-site scripting vulnerabilities?
xss-prevention equips you with practical techniques across the full attack surface. Learn to identify and eliminate vulnerable patterns like direct innerHTML assignment, eval() usage, and unsafe event handler binding. Master safe DOM manipulation by using APIs that treat content as text rather than markup. Implement allowlist-based filtering for user-generated content in rich text editors. Configure CSP headers with appropriate nonce values to prevent inline script execution. The skill covers both reflected and stored XSS prevention, ensuring you can secure data at every stage—from input validation through storage and final rendering.
What is the relationship between DOMPurify sanitization and preventing user input attacks?
xss-prevention teaches that DOMPurify is an allowlist-based sanitization library that removes dangerous HTML and JavaScript while preserving safe markup. When handling user-generated content—especially in rich text editors or comment systems—DOMPurify filters input against a whitelist of permitted tags and attributes, stripping any script tags, event handlers, or protocol-based URLs that could execute malicious code. This sanitization step is essential for securing user-generated content, but xss-prevention emphasizes it must be paired with output encoding and CSP headers for complete protection against injection attacks.
How do I set up Content Security Policy headers to block malicious script execution?
xss-prevention covers CSP configuration as a critical defense layer that blocks inline scripts and restricts script sources at the browser level. Configure headers like `Content-Security-Policy: script-src 'self'` to allow scripts only from your domain, or use nonce-based CSP (`script-src 'nonce-{random}'`) to permit only inline scripts with a matching nonce attribute, preventing attackers from injecting arbitrary scripts. You can also add `default-src 'self'` to restrict all resource loading. xss-prevention teaches you to implement CSP progressively, starting in report-only mode to identify legitimate script usage before enforcing strict policies that block malicious script execution.
What safe DOM APIs should I use instead of innerHTML to prevent DOM-based XSS attacks?
xss-prevention teaches that innerHTML parses and executes any script tags in the input, making it vulnerable to DOM-based XSS. Safe alternatives include textContent for plain text content (which treats all input as literal text), createElement() and appendChild() for programmatic DOM construction, and template literals with proper encoding. For dynamic HTML that must be rendered, combine these safe APIs with sanitization libraries like DOMPurify. The skill emphasizes learning secure DOM manipulation patterns so you avoid vulnerable APIs entirely, reducing your attack surface and ensuring that user-controlled data cannot be interpreted as executable code.
SKILL.md
rendered from the published skill — quoted content, verbatim
XSS Prevention
Overview
Implement comprehensive Cross-Site Scripting attack prevention through input sanitization, output encoding, Content Security Policy headers, and secure coding practices.
When to Use
- User-generated content display
- Rich text editors
- Comment systems
- Search functionality
- Dynamic HTML generation
- Template rendering scenarios
XSS Attack Types
| Type | Vector | Defense
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 3 files
plugins/xss-prevention/skills/xss-prevention/SKILL.md
plugins/xss-prevention/skills/xss-prevention/references/nodejs-advanced.md
plugins/xss-prevention/skills/xss-prevention/references/python-sanitization.md