hunt-html-injection

SUSPICIOUS: the skill is internally coherent as a vulnerability-hunting guide, but it equips an AI agent with offensive web exploitation procedures, including exfiltration-oriented payloads and XSS escalation. There is no supply-chain or credential-harvesting installer behavior, so this is high-risk security tooling rather than confirmed malware.