performing-soap-web-service-security-testing

SUSPICIOUS: the skill is internally consistent with its stated purpose, but that purpose is offensive security testing. It enables an AI agent to send exploit payloads, trigger OOB XXE callbacks, and potentially cause DoS, so overall risk is high despite low evidence of malware or deceptive data theft.

This is an active SOAP penetration-testing script. It contains intentionally intrusive XXE, denial-of-service, SQL injection, SOAPAction spoofing, and WS-Security bypass probes, which can harm or affect a target if run without authorization. No clear malware behavior such as persistence, credential theft, covert exfiltration, reverse shell execution, cryptomining, or system modification is present. The externally controlled WSDL and endpoint introduce a meaningful risk of unintended network requests, and the code should only be used against authorized systems with safeguards. The supplied fragment also has a syntax error at the end.