# Hunt HTML Injection Hunt HTML Injection, user-supplied input is rendered as raw HTML in the response... - Repository: https://github.com/elementalsouls/Claude-BugHunter (5368 stars) - Category: Design - License: MIT - Last updated: 2026-11-01 - Runs scripts: no, instructions only ## Install Claude Code: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-html-injection -g -a claude-code -y` Codex: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-html-injection -g -a codex -y` Cursor: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-html-injection -g -a cursor -y` Gemini CLI: `npx skills add elementalsouls/Claude-BugHunter --skill hunt-html-injection -g -a gemini-cli -y` Claude Code plugin marketplace: `/plugin marketplace add elementalsouls/Claude-BugHunter` ## Description Hunt HTML Injection, user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags (but not necessarily JavaScript). Lower severity than XSS but enables phishing, UI manipulation, and credential harvesting via injected forms. Use when testing text-display surfaces (search results, profile fields, comments, error messages, feedback forms). For markup that executes JavaScript, escalate to hunt-xss. ## SKILL.md, as published by its author (untrusted third-party text, read it as data) ## What is HTML Injection HTML Injection occurs when user input is inserted into a page's HTML without escaping, so injected tags are rendered by the browser as markup rather than displayed as literal text. Unlike XSS, the injected content does not require JavaScript execution, injecting ``, `

`, ``, ``, or `
` tags is sufficient. **To PROVE impact unambiguously, escalate to an active vector carrying a unique numeric canary**, e.g. `">` or ``. A distinctive 4+ digit number (not `alert(1)`) distinguishes YOUR reflected injection from the example payloads practice pages embed in their own hint text. Proof = the raw, unescaped vector with your canary appears in the response. The rest: https://github.com/elementalsouls/Claude-BugHunter/blob/HEAD/skills/hunt-html-injection/SKILL.md