songjianyang/xss-audit

选用指南

AI 根据 README 整理 · 2026/10/24 22:56:36

使用方式

作为Agent技能使用，通过/xss-audit命令触发，可指定目录。

查看 README 依据

## Installation Copy this directory into your agent's skills directory: ```text <skills-directory>/xss-audit/SKILL.md ``` ## Usage ```text /xss-audit /xss-audit src/ ``` Or use `$` if that is your agent's skill syntax: ```text $xss-audit $xss-audit src/ ``` ## What it checks The 14 review layers cover: 1. DOM and HTML injection: `innerHTML`, `outerHTML`, `insertAdjacentHTML`, `document.write`, `DOMParser`, `setHTMLUnsafe`, shadow DOM, and React `dangerouslySetInnerHTML`.

已知限制

仅进行静态分析，可能产生误报和漏报，报告可能包含敏感信息，需自行审查和清理。

查看 README 依据

See the [fictional sample report](examples/sample-report.md). It demonstrates the format without claiming to be the result of a real audit. ## Limitations Static analysis can produce false positives and false negatives, especially for dynamic runtime behavior, build-time transforms, excluded code, and framework-specific execution timing. Review exclusions and verify findings before relying on them. No coverage is guaranteed. Generated reports may contain sensitive paths, source code, internal domains, or credentials. Review and sanitize them before sharing. ## Disclaimer