xss-vulnerability-scanner

SUSPICIOUS: the skill is internally aligned with a security-testing purpose, but that purpose itself gives an AI agent offensive XSS-scanning capability and broad shell access. There is no direct evidence of malware, credential theft, or exfiltration, yet the vague instructions plus Bash(npm:*) make it a high-impact security tool with moderate execution-trust risk.