Hi,
That's because those paths need to be included in the filter.xml file, which specifies which parts of the repository can be synchronized. By default, these filters won’t be available in the filter.xml file. You can read more about it here: Apache Jackrabbit FileVault Filters.
What you need to do is ensure that your ui.apps/src/main/content/META-INF/vault/filter.xml file contains the following entry:
<filter root="/apps/cq/xssprotection/"/>
Hope this helps
Esteban Bustamante