A browser has to execute before a finding is confirmed
xss-specialist reserves CONFIRMED for findings backed by browser execution. A model's confidence cannot promote a suspected cross-site scripting flaw into that state. That is a useful rule when a report could otherwise confuse reflected text with executable code. The project combines an experimental security model with an assessment system for authorized targets, and the distinction between those components determines how much trust to give its output.
Our 43 passing tests are encouraging for anyone inspecting that design. They do not establish how well it finds flaws in an unfamiliar application. The README calls the project a research prototype and limits the live system to an authorized pilot. I would consider it for studying how to keep model advice separate from security evidence, with an analyst reviewing the results before taking action.
What happened when we ran it
Our run installed commit b000fc3 in 43 seconds, pulling 115 packages and occupying 5,868 MB on disk. The build succeeded in 1 second. Pytest then passed all 43 tests in 4 seconds, with 0 failures. The October 15, 2026 sandbox was an unprivileged Debian container using Python 3.12, 3 CPUs, and 8 GB of RAM, without secrets.
Pip-audit reported 0 known vulnerabilities. The repository contained 188 files, roughly 6,923 source lines, and a 6 MB checkout before installation. Our scan found a tests directory, no CI workflow files, and no Dockerfile. That is a sizable installed environment for a small source checkout, so leave room for the dependency footprint when preparing a disposable evaluation environment or moving it between machines.
The 4-second pytest result covers the command our harness ran. It does not show that we trained a specialist model, completed the separate browser acceptance workflow, or assessed an external site. Those activities have their own prerequisites. Keeping that boundary explicit prevents a green software check from becoming an unsupported statement about vulnerability-detection accuracy or readiness for a client engagement.
The decision server defaults to a heuristic backend
The decision API instructions say the default server identifies itself as xss-decision-mock. Its reference backend is a deterministic heuristic, intended for developing the interface and clients. Loading a learned checkpoint requires an explicit command and the decision extra. Check what the server actually loaded before treating a probability response as evidence from a trained XSS specialist.
The 115 packages in our install do not change that default. The repository separates model research, knowledge routing, and browser assessment, so a successful command in one area says little about the others. Its model research also reports rejected candidates because they confused sanitizer names with similar-looking identifiers. An apparent safety judgment about a familiar library name deserves particular skepticism when the identifier in the code differs.
The live system uses exact sanitizer identity and execution evidence to avoid relying on that resemblance. Its findings can remain LIKELY or INCONCLUSIVE instead of being forced into a yes-or-no answer. That is useful for an analyst who needs to inspect the reason for a result. It also means someone must handle the unresolved queue, including suspicious reflections that never execute in the observed browser path.
Apple Silicon is the documented model platform
The quick-start prerequisites name macOS on Apple Silicon and Python 3.12 or newer. MLX training and inference are currently limited to that hardware path. The instructions also require a separate Playwright Chromium download. Our successful Debian package setup does not establish that the MLX model workflow works on a Linux server, and a team standardized on Linux should settle that distinction before adoption.
At 5,868 MB on disk in our run, the dependency environment is already a practical consideration before arranging model assets. The repository keeps models, adapters, and run outputs outside Git. A repeatable research setup therefore needs those artifacts recorded alongside the source revision. For a scanner evaluation, start with the documented local browser workflow rather than assuming package installation has exercised Chromium or the trained model.
Authenticated apps and SPAs have acknowledged coverage gaps
The README limitations say SPA and authentication flows receive light coverage, along with POST bodies, headers, JSON inputs, and path parameters. It also identifies dead code and CSP-blocked reflections as cases that can remain LIKELY. These are specific reasons to choose a broader assessment tool when your application depends heavily on login state or client-side navigation.
Passing 43 tests does not close those coverage gaps. The pilot code requires an operator identity and authorization acknowledgement, and external targets also require a passed local acceptance evaluation. Scope settings bound where assessment can go. Reports preserve the authorization record and require human review, while live findings stay quarantined from automatic model training. Those controls suit an experiment that should leave inspectable evidence about what it attempted.
September changes have little public support history
GitHub showed a September 28, 2026 push, 155 stars, and 0 open issues and PRs. The recent issue endpoint returned no entries, and the latest-release endpoint returned no release, although the README links experimental checkpoint release tags. Together these facts show recent source activity with little issue history to judge. The latest-release response alone cannot establish that no tagged artifacts exist.
The 43-second install and passing suite make xss-specialist practical to inspect if you can spare the disk space. For routine authorized XSS scanning, compare Dalfox, or ZAP when you need a broader web assessment environment. Choose this repository when the research controls and evidence trail are the reason for the evaluation. Require an analyst to reproduce a finding before it enters a security report.