exploiting-broken-link-hijacking

SUSPICIOUS. The skill is internally aligned with its stated purpose, but that purpose is to equip an AI agent with offensive security capabilities, including exploit validation and takeover PoCs with real-world impact. Install sources are mostly official/open-source tools, so this is not confirmed malware, but the combination of offensive scanning, untrusted-content ingestion, and autonomous takeover-oriented actions makes it high risk for AI-agent deployment.

The code is a legitimate broken-link and potential hijacking scanner, with no evident malicious payload or covert exfiltration. It has meaningful security weaknesses: disabled TLS verification, unrestricted user-controlled and page-controlled outbound requests, redirect following, and unrestricted report-file writes. The domain-takeover classification is unreliable because connection failure alone does not prove domain unregistration.