feat: add XSS built-in agent skill with Dalfox workflow

[Shafranpackeer]

Summary

Add XSS (Cross-Site Scripting) attack skill following the same prompt-based pattern as SQLi.

Features:

• 7-step Dalfox workflow (target analysis, detection, WAF bypass, exploitation, long scan, payload generation, evidence collection)
• OOB blind XSS workflow using Interactsh callbacks
• Comprehensive WAF bypass techniques
• UI settings for workers, timeout, WAF bypass mode, deep DOM analysis

WAF Bypass Techniques:

• HTML entity encoding (<script>)
• Hex/Unicode encoding (\x3c, \u003c)
• Double URL encoding (%253C)
• Case mixing (<ScRiPt>)
• Null byte injection (<scri%00pt>)
• Comment insertion (<scr<!---->ipt>)
• Event handler payloads (onerror, onload, onfocus, ontoggle)
• Context-specific payloads (attribute, JS string, template literal)

Blind XSS with OOB Callbacks:

• Interactsh integration for blind XSS detection
• Dalfox --blind flag support
• Cookie/session/DOM data exfiltration payloads

Type of Change

• New feature

Component(s)

• webapp (Next.js)
• agent (Python)

How to Test

# Verify Python syntax
cd agentic && python -m py_compile prompts/xss_prompts.py prompts/classification.py

# Test format placeholders
python -c "from prompts.xss_prompts import XSS_TOOLS; from project_settings import get_xss_settings_dict; XSS_TOOLS.format(**get_xss_settings_dict())"

# Verify classification wiring
python -c "from prompts.classification import _BUILTIN_SKILL_MAP; print('xss' in _BUILTIN_SKILL_MAP)"

Checklist

• I have tested this change locally with docker compose
• I have not included real-world target data
• My commits follow Conventional Commits
• I have read and agree to the DISCLAIMER.md

Screenshots

N/A - Backend prompts + settings UI, no major visual changes

Related Issues

Follows same pattern as SQLi skill implementation