hunt-dom

SUSPICIOUS. The skill’s offensive footprint is coherent with its stated purpose, but that purpose is to help an AI agent conduct browser-side exploitation and data exfiltration. There is no major installer/supply-chain concern in the text itself, yet the explicit secret-capture workflows, OOB exfil endpoints, and service-worker persistence make it a high-risk security skill rather than a benign developer aid.