Analyze and validate cross-site scripting in web/UI code — use when reviewing HTML sinks, DOM APIs, template escaping, dangerouslySetInnerHTML, or reflected/stored XSS paths (CWE-79 / A03:2021).
