xss-stored

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly requires collecting and reporting discovered credentials/tokens (and saving evidence like "ssrf-aws-creds.json") and to leverage existing credentials from state, which implies outputting secret values verbatim — an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document is an explicit offensive playbook for exploiting stored and blind XSS — it contains step‑by‑step payloads and infrastructure instructions to exfiltrate cookies/localStorage, load remote attacker scripts, perform CSRF to create admin accounts, keylog keystrokes, and otherwise enable remote data theft and unauthorized actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs injecting external callback scripts such as (and similar //YOUR_SUBDOMAIN.xss.ht or https://ATTACKER:8080/blind) which will be fetched and executed in the victim/browser during runtime and are required for blind-XSS testing, so remote content directly controls code execution.