def generate_payload(spec: str) -> str:
    if 'xss' in spec.lower():
        return '<script>alert(document.domain)</script>'
    if 'sql' in spec.lower():
        return "' OR '1'='1' -- "
    return f"# Custom payload for {spec}\necho 'Inject here...'"