xss-audit is a Claude skill for a 14-layer static scan of React code

Most review of a frontend pull request still runs on the eyes of one person.

A security researcher who goes by songjianyang on GitHub released xss-audit on 24 October 2026. It is an agent skill for Claude Code or any agent that reads SKILL.md files. The repository has 204 stars under the MIT license on the day after its first commit. The project runs 14 layers of static cross-site-scripting checks against a React, TypeScript or JavaScript codebase. It writes its findings to a file named xss-audit-report.md.

Who wrote it

The author states in the README that the skill came from one year of hands-on bug bounty work. During that period, the author says they ranked in Microsoft's MSRC Security Researcher Leaderboard for four quarters in a row. The author lists the exact positions: 2025 Q3 at number 4, Q4 at number 7, 2026 Q1 at number 6 and Q2 at number 10. The author links to the MSRC leaderboard and to an X profile at @SecBoxer. The project page says the skill helped find dozens of XSS bugs that were paid as bounties.

What the 14 layers cover

Layers 1 to 3 cover direct HTML and URL sinks. The list names innerHTML, outerHTML, insertAdjacentHTML, document.write, DOMParser, React's dangerouslySetInnerHTML, and all href, src and action assignments. Layer 3 also enumerates URL-validation anti-patterns. It names hostname-only checks, substring checks that pass trusted.com.evil.com, and backslash-confusion URLs like https:\\evil.com.

Layers 4 to 7 cover JSON-in-script injection in server-rendered bootstraps. They also cover prop spreading onto untrusted sinks, prototype pollution chains, and messages crossing an iframe or a worker. Layers 8 to 10 cover eval, new Function, worker-script imports, CSS injection paths and SVG, MathML and XML name-space confusion.

Layers 11 to 14 cover Markdown pipelines with sanitizers. They cover framework trust-bypass APIs for Vue, Angular, Svelte and Lit. They cover Trusted Types and Content Security Policy gaps. And they cover template bindings in KnockoutJS, Alpine, Vue and Angular. In those bindings, attacker input can reach the template compiler.

What it will not do

The author is direct about the limits. The README calls the skill static analysis only. It states that a search match is not a confirmed vulnerability. The author lists four reasons why no static checklist can guarantee complete coverage. They are new browser APIs, framework abstractions, dynamic code paths and build-time transforms. The author recommends pairing the skill with dynamic testing and defence-in-depth measures like CSP and Trusted Types.

Where it fits

The useful part of a tool like this is not the audit score. It is the drop in the review work a senior engineer has to do by hand. The scan runs against a draft before a human reads it. A junior reviewer then sees fewer raw sinks to trace from scratch. A finding still has to be verified in the real data flow. The README asks for this in rule 3 of its execution rules. But the first pass is cheaper. The second pass is a diff against a report rather than against the whole file.

Source

songjianyang/xss-audit on GitHub.