hunt-html-injection

This skill is internally consistent with its stated purpose, but that purpose is offensive security testing. It does not show credential theft, hidden exfiltration, or malicious installer behavior in the skill body; however, it equips an AI agent to conduct active web exploitation and escalation, making it high-risk as a capability even without confirmed malware.