# html-injection-testing

This skill guides checks for HTML injection in web apps and helps assess how injected markup affects rendered pages. Use it when reviewing user-input handling.

- skill · `type=skill` · Claude Code · 234 installs
- Author: zebbern
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/html-injection-testing
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/html-injection-testing

## What it does

The skill outlines checks for places where an app displays user-provided values, including form fields, URL parameters, comments, and error messages. It covers reflected and stored injection, along with input sent through POST requests. The material distinguishes HTML injection from XSS, where JavaScript execution is involved.

The workflow uses `curl` and an intercepting proxy such as Burp Suite or OWASP ZAP. You’ll need basic HTML knowledge, familiarity with HTTP requests and responses, and an understanding of how web apps handle input. Only test applications with permission: these checks can alter page content.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/html-injection-testing
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill html-injection-testing -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/html-injection-testing/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/html-injection-testing/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/html-injection-testing/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/html-injection-testing/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates html-injection-testing
```

2. **Manually: put the files in place**
- File: `.github/skills/html-injection-testing/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/html-injection-testing
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/html-injection-testing/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/html-injection-testing

## When to use it
- locate inputs and parameters reflected in a page
- check how an app renders submitted markup
- tell HTML injection apart from JavaScript execution
- document the effect of injected content on a page
- draft input-handling recommendations

## Example prompts
- Review my app for fields and parameters that may reflect HTML, then list suitable test points.
- Explain how to distinguish HTML injection from XSS while assessing my application.
- Prepare a report on HTML injection findings and ways to review user-input handling.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 495 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md