Xss Prevention

This covers the essential XSS prevention techniques you actually need: HTML entity encoding for text content, DOMPurify for sanitizing rich HTML, and CSP headers to lock down what can execute. The quick start shows a practical Node.js implementation, and the reference guides extend it to Python and React. Worth noting it takes the right approach by defaulting to encoding rather than sanitization, only using the heavier sanitization when you truly need rich content. The best practices section is short but hits the critical points, especially the warning against innerHTML and mixing contexts. If you're displaying user generated content anywhere, this gives you a solid defensive setup without overthinking it.

skills.sh installs: 482
GitHub stars: 379
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add aj-geddes/useful-ai-prompts --skill xss-prevention --agent claude-code

Installs into .claude/skills of the current project.

Files

Overview

Implement comprehensive Cross-Site Scripting (XSS) prevention using input sanitization, output encoding, CSP headers, and secure coding practices.

When to Use

User-generated content display
Rich text editors
Comment systems
Search functionality
Dynamic HTML generation
Template rendering

Quick Start

Minimal working example:

// xss-prevention.js
const createDOMPurify = require("dompurify");
const { JSDOM } = require("jsdom");
const he = require("he");

const window = new JSDOM("").window;
const DOMPurify = createDOMPurify(window);

class XSSPrevention {
  /**
   * HTML Entity Encoding - Safest for text content
   */
  static encodeHTML(str) {
    return he.encode(str, {
      useNamedReferences: true,
      encodeEverything: false,
    });
  }

  /**
   * Sanitize HTML - For rich content
   */
  static sanitizeHTML(dirty) {
    const config = {
      ALLOWED_TAGS: [
// ... (see reference guides for full implementation)

SKILL.md on GitHub