Xss prevention

Skill ulpi-io/plugin-marketplace/plugins/aj-geddes/skills/xss-prevention

Prevent Cross-Site Scripting (XSS) attacks through input sanitization, output encoding, and Content Security Policy. Use when handling user-generated content in web applications.From its SKILL.md

Install

npx -y skills add ulpi-io/plugin-marketplace --skill xss-prevention

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.2 KB, 483 tokens by cl100k_base, as published. Nobody here has run it

Overview

Implement comprehensive Cross-Site Scripting (XSS) prevention using input sanitization, output encoding, CSP headers, and secure coding practices.

When to Use

User-generated content display
Rich text editors
Comment systems
Search functionality
Dynamic HTML generation
Template rendering

Quick Start

Minimal working example:

// xss-prevention.js
const createDOMPurify = require("dompurify");
const { JSDOM } = require("jsdom");
const he = require("he");

const window = new JSDOM("").window;
const DOMPurify = createDOMPurify(window);

class XSSPrevention {
  /**
   * HTML Entity Encoding - Safest for text content
   */
  static encodeHTML(str) {
    return he.encode(str, {
      useNamedReferences: true,
      encodeEverything: false,
    });
  }

  /**
   * Sanitize HTML - For rich content
   */
  static sanitizeHTML(dirty) {
    const config = {
      ALLOWED_TAGS: [
// ... (see reference guides for full implementation)

Reference Guides

Detailed implementations in the references/ directory:

Guide	Contents
Node.js XSS Prevention	Node.js XSS Prevention
Python XSS Prevention	Python XSS Prevention
React XSS Prevention	React XSS Prevention
Content Security Policy	Content Security Policy

Best Practices

✅ DO

Encode output by default
Use templating engines
Implement CSP headers
Sanitize rich content
Validate URLs
Use HTTPOnly cookies
Regular security testing
Use secure frameworks

❌ DON'T

Trust user input
Use innerHTML directly
Skip output encoding
Allow inline scripts
Use eval()
Mix contexts (HTML/JS)

What ships with it: 5 files

10.9 KB alongside SKILL.md

references/

templates/

component-template.tsx318 B

Gives 0 of the 12 instructions most vulnerability scanning skills give in 483 tokens

Counted across 223 of the 238 authors here whose files we hold, read 2026-09-06

Fix critical findings immediatelyin 21 of 223, across 14 files
Fix high findings before productionin 18 of 223, across 12 files
Check and install AgentShield before scanningin 18 of 223, across 12 files
Scaffold a secure configuration with initin 16 of 223, across 10 files
Add the AgentShield GitHub Action to CIin 16 of 223, across 10 files
Run the three-agent opus pipeline for deeper analysisin 14 of 223, across 8 files
Apply safe auto-fixes onlyin 14 of 223, across 8 files
Use JSON output for CI/CD integrationin 13 of 223, across 7 files
Filter findings with a minimum severityin 12 of 223, across 10 files
Classify each finding by severityin 10 of 223
Use parameterized queries for all database accessin 10 of 223, across 9 files
Write tests before writing the rulein 9 of 223, across 4 files

Said here and by no other author read

Encode output by default
Use templating engines
Implement CSP headers
Sanitize rich content
Validate URLs
Use HTTPOnly cookies

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.