The victim of your XSS attack will not use the console, so when creating a XSS attack it shouldn't require the use of the console to activate it.

I can break any website for myself by putting stuff in the console.

Kinda not within the spirit of the exercise don't you think.