Html Injection Testing

Name: Html Injection Testing
Author: sickn33

Listed

sickn33·vlatest·security·MIT

Identifies potential XSS vulnerabilities by attempting HTML injection into input fields and observing output.

Repository

Install on your platform

Showing Claude Code. One command installs this skill into any of the agents below.

Run this in your project

terminal

$ npx skills add sickn33/agentic-awesome-skills --skill html-injection-testing -a claude-code

Uses the open-source skills CLI and needs Node.js. Add -g to install it for your user instead of this project.

What we know about this skill

Publisher

sickn33

Taken from the source listing. We haven't verified who controls this account.

Install target

Live repository

Not pinned. Installing fetches whatever the repository holds at the time you run the command.

No human has reviewed this code. The checks below are a static scan of the files at one commit — nobody has run this skill or judged whether it works. A skill runs with whatever access you give your agent, so read the source before you install it.

Automated safety checks

scanned 28 Sept 2026

This skill failed 1 of 6 checks. A failure is not proof of bad intent; it means something in the code needs a human to look at it before you run it.

Declares what it does: failed
No SKILL.md was found in the skill's directory.
SKILL.md exists, its frontmatter parses, and it declares a name and a description.
No undeclared network calls: passed
Makes no network calls.
Every host the skill dials — from its scripts, its config endpoints or the commands it tells the agent to run — is either well-known package and API infrastructure or declared in its own frontmatter. Links in documentation are not counted.
No obfuscated payloads: passed
No encoded or obfuscated payloads.
No base64, hex or compressed blob is decoded and then executed, and no encoded shell commands.
No credential access: passed
Reads no keys, tokens, keychains or credential files.
Neither the code nor the SKILL.md instructions read SSH keys, cloud credentials, keychains, token stores, browser cookie databases or dotfiles that hold secrets.
No pipe-to-shell installers: passed
No pipe-to-shell or download-and-run installers.
No `curl … | sh` pattern, in the code or in the instructions, that runs code fetched at run time.
Pinned to a commit: passed
Scanned sickn33/antigravity-awesome-skills at 5a4cdd9df8.
The exact upstream commit SHA that was scanned is recorded, so the result refers to specific bytes.

Commit: 5a4cdd9df8
Manifest: skills/html-injection-testing/SKILL.md
Scanned: 0 files
Copies in repo: 3 — all of them scanned

This is a static scan, not a review. It reads the skill's files; it does not run them, and it cannot tell you whether the skill is any good or whether the code does what its description says. A skill runs with whatever access you give your agent.

What each check looks for →

About this skill

The HTML Injection Testing skill enables AI agents to systematically probe web applications for vulnerabilities where malicious scripts are embedded into web pages. It automates the process of identifying injection flaws that could allow attackers to execute arbitrary code within a user's browser session. This capability is essential for security professionals seeking to validate defenses against cross-site scripting (XSS) attacks before they can be exploited in production environments.

Vulnerability Discovery: Automatically scan input fields, forms, and dynamic content areas to detect potential injection points.
Payload Execution Simulation: Test how applications handle malicious HTML tags and scripts without requiring manual browser interaction.
Risk Assessment: Generate reports highlighting specific locations where user-controlled data is rendered unsafely.
Compliance Verification: Assist in meeting security standards that require regular testing for client-side code injection flaws.
Automated scanning of dynamic web interfaces for unsafe HTML rendering.
Simulation of malicious script insertion into various input vectors.
Identification of reflected, stored, and DOM-based injection vulnerabilities.
Detailed reporting on specific endpoints and parameters susceptible to exploitation.

"Scan this login page for HTML injection vulnerabilities before we deploy the new authentication flow."

"Test the search functionality of this e-commerce site to see if it reflects user input as executable HTML."

"Run an automated assessment on our blog comments section to check for stored XSS risks using this tool."

Prerequisites: Ensure you have appropriate authorization and legal permission to test the target application, as injection testing can disrupt services.
Limitations: This skill focuses on client-side rendering issues; it may not detect server-side logic flaws or backend database injection attacks that do not result in immediate HTML output.