scanning-for-xss-vulnerabilities

SUSPICIOUS. The skill is internally mostly coherent and narrowly permissioned, with no clear credential theft, exfiltration, or supply-chain abuse in the provided text. However, it enables AI-driven vulnerability scanning, which is a high-risk offensive-security capability, and its claimed active testing behavior is underspecified relative to its allowed tools.