pentest-xss

SUSPICIOUS. The skill is internally coherent for XSS assessment and shows no install-chain, credential-forwarding, or third-party exfiltration behavior in the provided text, but it gives an AI agent offensive security capabilities against web targets. Risk is driven by pentest actionability rather than evidence of malware or covert credential theft.