blind-xss
Use when the plausible consumer of an input is a human or system the agent cannot observe - support tickets, moderation queues, grant/partner applications…
Skill by ghostonbutterbread
Install
Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.
npx agentmarket install skill/ghostonbutterbread-blind-xss
Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.
Get the weekly diff
The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.
About
Use cases: agent-building
Reviews
Write a reviewNo reviews yet. Installed it? Reviews come from verified installers only. How reviews work
Permissions
What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.
- Tools
- No tools found
- Secrets
- None asked for
- Install scripts
- None found
Network hosts it talks to 1
codeload.github.com· found in install command
Files it touches
~/.claude/skills/blind-xss
What's inside
- Skill name
blind-xss- Description
- Use when the plausible consumer of an input is a human or system the agent cannot observe - support tickets, moderation queues, grant/partner applications, staff dashboards, log viewers, or any stored field with unaccountable render points. Load as a lane from the xss router. Owns callback collection, correlation, capture boundaries, and deferred (Pending-OOB) lifecycle for blind XSS.
- License
- unknown
- Instructions
- 215 lines in SKILL.md · view on GitHub
Before installing
- Instructions call the network
Files (2)
- SKILL.md
- _meta.json
The license isn't open source, so the instructions aren't shown here. Read SKILL.md on GitHub
More from ghostonbutterbread/bug-bounty-harness
- 0.565score
bounty-tools
ghostonbutterbread
Use when running external bug bounty tooling such as nmap, ffuf, dirbuster, gobuster, dalfox, dursgo, ssrfmap, nuclei, httpx, katana, gau, or one-off…
SkillAFreshness: AClaude Code +9 - 0.561score
access-control
ghostonbutterbread
Route broken access control, IDOR, BOLA, role, tenant, workflow, method, header, path, and auth-state testing into focused authorization lanes.
SkillAFreshness: AClaude Code +9 - 0.561score
analyze-endpoint
ghostonbutterbread
Analyze a proxy-observed endpoint into reusable request contracts, parameter dictionaries, sanitized replay templates, and fuzzing handoffs.
SkillAFreshness: AClaude Code +9 - 0.557score
ato
ghostonbutterbread
Route account takeover testing across signup, recovery, SSO/OAuth, account linking, MFA, email change, sessions, invites, and identity-binding flows.
SkillAFreshness: AClaude Code +9 - 0.554score
account-management
ghostonbutterbread
Record and look up non-secret bug bounty test account, PwnFox lane, and owned resource identifiers.
SkillAFreshness: AClaude Code +9 - 0.553score
agent-proxy
ghostonbutterbread
Lease and use the task-scoped agent MITM listener that captures active agent traffic.
SkillAFreshness: AClaude Code +9 - 0.553score
bb-script-rules
ghostonbutterbread
Use when running a bug-bounty script to investigate a target in BBH.
SkillAFreshness: AClaude Code +9 - 0.524score
403
ghostonbutterbread
Use when an in-scope endpoint returns 403 Forbidden and the agent owns the endpoint or it is a server endpoint safe to probe with bounded access-bypass checks.
SkillBFreshness: BClaude Code +9 - 0.524score
bounty-notes
ghostonbutterbread
Use when bug bounty agents need durable hunt narrative: timeline, decisions, hypotheses, handoffs, blockers, FAQs, next-agent guidance, or sanitized artifact…
SkillBFreshness: BClaude Code +9 - 0.521score
ai-tester
ghostonbutterbread
Test AI features for prompt injection, tool abuse, model-mediated IDOR, scanner SSRF, output sinks, and action-boundary failures.
SkillBFreshness: BClaude Code +9 - 0.519score
api-surface-mapping
ghostonbutterbread
Use when mapping, comparing, or systematically testing an API surface.
SkillBFreshness: BClaude Code +9 - 0.518score
blockers
ghostonbutterbread
Use when an agent hits an external prerequisite it cannot solve, or needs an end-of-run blocker brief.
SkillBFreshness: BClaude Code +9
Signals
- Stars
- 0
- Forks
- 0
- Open issues
- 0
- Last commit (this folder)
- Oct 6, 2026 (23 days ago)
From GitHub (fetched Oct 24, 2026).
Details
- License
- License unknown
- First seen
- Oct 24, 2026
- Last checked
- Oct 24, 2026
- Source
- GitHubgithub-graphql
More from ghostonbutterbread
- 0.565score
bounty-tools
ghostonbutterbread
Use when running external bug bounty tooling such as nmap, ffuf, dirbuster, gobuster, dalfox, dursgo, ssrfmap, nuclei, httpx, katana, gau, or one-off…
SkillAFreshness: AClaude Code +9 - 0.561score
analyze-endpoint
ghostonbutterbread
Analyze a proxy-observed endpoint into reusable request contracts, parameter dictionaries, sanitized replay templates, and fuzzing handoffs.
SkillAFreshness: AClaude Code +9 - 0.561score
access-control
ghostonbutterbread
Route broken access control, IDOR, BOLA, role, tenant, workflow, method, header, path, and auth-state testing into focused authorization lanes.
SkillAFreshness: AClaude Code +9 - 0.557score
ato
ghostonbutterbread
Route account takeover testing across signup, recovery, SSO/OAuth, account linking, MFA, email change, sessions, invites, and identity-binding flows.
SkillAFreshness: AClaude Code +9 - 0.554score
account-management
ghostonbutterbread
Record and look up non-secret bug bounty test account, PwnFox lane, and owned resource identifiers.
SkillAFreshness: AClaude Code +9 - 0.553score
bb-script-rules
ghostonbutterbread
Use when running a bug-bounty script to investigate a target in BBH.
SkillAFreshness: AClaude Code +9
Cite this page
blind-xss skill. Agent Mart. https://agentmart.dev/skills/ghostonbutterbread-blind-xss (last updated 2026-10-24)