Netflix-Skunkworks/sleepy-puppy

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1044 stars · 138 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Sleepy Puppy is a cross-site scripting (XSS) payload management framework from Netflix Skunkworks that captures, manages, and tracks XSS payload propagation across applications over time. It provides customizable payloads, PuppyScripts, and collectors that report back when and where injected payloads execute, even long after the initial test.

Use cases

• track delayed XSS payload execution across applications
• capture screenshots and DOM context when an XSS payload fires
• manage and organize XSS payloads by assessment
• get email notifications when an injected payload executes
• trace cross-application XSS propagation during penetration tests
• integrate XSS payload tracking with Burp or ZAP via API

When to choose

• you need to detect XSS payloads firing in applications other than the one under test
• you want long-term tracking of client-side injection execution with rich capture metadata
• you need email alerts when delayed XSS events occur

When to avoid

• you need an actively maintained tool - the project was deprecated in July 2018
• you only need simple, immediate XSS scanning rather than payload propagation tracking
• you cannot self-host a Python/JavaScript web application

Facets

application · maturity abandoned

security web-framework http-server api-framework security web-development penetration-testing python xss payload-management penetration-testing deprecated web-server javascript

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Netflix-Skunkworks/sleepy-puppy")