Skip to main content
affpapa.org
RU EN
skill

html-injection-testing — Claude Code skill: testing and setup

This skill guides checks for HTML injection in web apps and helps assess how injected markup affects rendered pages. Use it when reviewing user-input handling.

Install into Claude Code · claude-code-templates All methods and platforms ↓ 
npx claude-code-templates@latest --skill security/html-injection-testing
Open on GitHub

What html-injection-testing does

The skill outlines checks for places where an app displays user-provided values, including form fields, URL parameters, comments, and error messages. It covers reflected and stored injection, along with input sent through POST requests. The material distinguishes HTML injection from XSS, where JavaScript execution is involved.

The workflow uses curl and an intercepting proxy such as Burp Suite or OWASP ZAP. You’ll need basic HTML knowledge, familiarity with HTTP requests and responses, and an understanding of how web apps handle input. Only test applications with permission: these checks can alter page content.

What it helps with

  • locate inputs and parameters reflected in a page
  • check how an app renders submitted markup
  • tell HTML injection apart from JavaScript execution
  • document the effect of injected content on a page
  • draft input-handling recommendations

Example prompts for the agent

  • Review my app for fields and parameters that may reflect HTML, then list suitable test points.
  • Explain how to distinguish HTML injection from XSS while assessing my application.
  • Prepare a report on HTML injection findings and ways to review user-input handling.

How to install html-injection-testing

1claude-code-templates

npx claude-code-templates@latest --skill security/html-injection-testing

2Skills CLI (Vercel)

npx skills add davila7/claude-code-templates --skill html-injection-testing -a claude-code

3Manually: put the files in place

~/.claude/skills/html-injection-testing/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/html-injection-testing/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about html-injection-testing

How do I install html-injection-testing in Claude Code?

Run npx claude-code-templates@latest --skill security/html-injection-testing.

What does html-injection-testing do?

It guides checks for user input rendered as HTML and helps assess how that input can change a page. The workflow covers both stored and reflected cases.

What do I need to test with this skill?

You’ll need basic HTML knowledge, familiarity with HTTP requests and responses, plus curl and an intercepting proxy such as Burp Suite or OWASP ZAP.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set495

The whole set →
autonomous-agent-patterns This skill outlines how autonomous coding agents can plan work, call tools, and involve a person in decisions. Use it when shaping an agent’s architecture or tool APIs. 239installs load-llms-txt Loads external documentation from llms.txt or a custom source and adds project context. Useful when an agent needs reference material during coding. 239installs nextjs-migration-helper A Claude slash command that walks a Next.js project from Pages Router to App Router, from JavaScript to TypeScript, and from class components to hooks. 237installs team-knowledge-mapper A slash command that builds a skill matrix for your team, finds knowledge gaps and suggests learning paths. Useful before planning hires or training. 235installs estimate-assistant Estimate tasks from Git history, code complexity, and team velocity. Use it to plan sprint work or compare estimates with past outcomes. 233installs migrate-to-typescript This command guides a JavaScript project through a TypeScript migration, from compiler setup to type fixes. Choose a gradual, complete, strict, or incremental approach. 230installs publisher-all One command runs four publishing flows in a row: an X thread, a LinkedIn post, a Medium article and a Dev.to RSS feed. 229installs archive A slash command that stores completed orchestrations with their metrics and lessons, so you can look back at them later. 228installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor