mcpField
C
client-side

client-side

github.com/transilienceaiSecurity598197 installsUpdated 13w ago
Repository

About client-side

client-side is a security skill for testing vulnerabilities in modern web applications and SPAs. It examines browser-side input flows and defenses across XSS, CSRF, CORS, clickjacking, DOM issues, and prototype pollution.

Key features

  1. 01Tests reflected, stored, and DOM XSS
  2. 02Checks CSRF and CORS weaknesses
  3. 03Assesses clickjacking protections
  4. 04Analyzes DOM sources and sinks
  5. 05Tests prototype pollution

Use cases

  1. 01Assess client-side security in a web app
  2. 02Trace input flows to browser-side sinks
  3. 03Document exploit impact and remediation

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/transilienceai/communitytools --skill client-side

After installing, type/client-sidein Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

reference/
clickjacking-cheat-sheet.md
clickjacking-quickstart.md
client-side-principles.md
cors-cheat-sheet.md
cors-quickstart.md
csrf-quickstart.md
dom-xss-advanced.md
dom-xss-quickstart.md
INDEX.md
prototype-pollution-quickstart.md
prototype-pollution-resources.md
reference/scenarios/dom-vulnerabilities/
angularjs-injection.md
detection-methodology.md
document-write-sink.md
dom-clobbering-globals.md
dom-clobbering-sanitizer-bypass.md
dom-xss-fundamentals.md
exfiltration-and-chaining.md
innerhtml-sink.md
jquery-sinks.md
postmessage-vulnerabilities.md
prevention-best-practices.md
prototype-pollution-dom.md
tools-and-automation.md
waf-filter-bypass.md
reference/scenarios/prototype-pollution/
bypass-techniques.md
client-side-pollution.md
detection.md
gadget-discovery.md
prevention.md

Details

From the project README

Client-Side

Test for client-side vulnerabilities across modern web applications and SPAs.

Techniques

TypeKey Vectors
XSSReflected, Stored, DOM-based, framework-specific (React, Vue, Angular)
CSRFToken bypass, SameSite cookie bypass, cross-origin requests
CORSMisconfigured origins, null origin, wildcard credentials
ClickjackingFrame-based, drag-and-drop, multi-step
DOM-basedDOM sinks, source/sink analysis, JavaScript URL schemes
Prototype PollutionClient-side gadgets, server-side pollution, property injection

Workflow

  1. Identify input sources and data flows
  2. Classify sink contexts (HTML, attribute, URL, JS, CSS)
  3. Enumerate defenses (encoding, CSP, sanitizers, Trusted Types)
  4. Craft context-appropriate payloads
  5. Validate execution and demonstrate impact
  6. Document with reproduction steps and remediation

Reference

  • reference/xss*.md - XSS bypass techniques and exploitation
  • reference/csrf*.md - CSRF techniques and bypasses
  • reference/cors*.md - CORS misconfiguration testing
  • reference/clickjacking*.md - Clickjacking techniques
  • reference/dom*.md - DOM-based vulnerability testing
  • reference/prototype-pollution*.md - Prototype pollution techniques

Comments

Markdown supported