hunt-xss

SUSPICIOUS: the skill is internally consistent as an offensive XSS-hunting guide, but that stated purpose itself grants an AI agent high-risk exploit capabilities against arbitrary third-party targets. There is no notable installer or credential-forwarding supply-chain concern, and the command-substitution findings are documentation false positives, but the operational footprint strongly enables data theft, token exfiltration, session hijacking, and autonomous exploit chaining.