testing-for-xss-vulnerabilities-with-burpsuite

SUSPICIOUS. The skill's capabilities align with its stated purpose, but that purpose is to equip an AI agent for offensive web security testing, which is inherently high risk. Install sources are mostly legitimate and verifiable, so this is not confirmed malware, but the combination of exploit guidance, third-party tooling, and credential-bearing scan workflows makes it a high-risk security skill.

This module is a purpose-built offensive security scanner for reflected XSS and basic CSP weakness detection, with stored-XSS probing implemented but not invoked in the shown main() flow. It does not exhibit typical covert malware traits (no persistence, exfiltration, command execution, or obfuscated payload delivery), but it actively injects and submits attack payloads to a target and disables TLS certificate verification for all requests. If run against unauthorized systems, it poses a significant misuse/security risk; even for authorized testing, verify=False is a notable security hygiene concern.