xss-testing-burpsuite

SUSPICIOUS: the skill is internally coherent as an XSS-testing guide, but it gives an AI agent explicit offensive security capabilities with live exploitation and exfiltration payload examples. Install provenance is mostly legitimate, so the main concern is high-risk misuse potential rather than covert malware behavior.

This module is a purpose-built offensive security scanner for reflected XSS and basic CSP weakness detection, with stored-XSS probing implemented but not invoked in the shown main() flow. It does not exhibit typical covert malware traits (no persistence, exfiltration, command execution, or obfuscated payload delivery), but it actively injects and submits attack payloads to a target and disables TLS certificate verification for all requests. If run against unauthorized systems, it poses a significant misuse/security risk; even for authorized testing, verify=False is a notable security hygiene concern.