hunt-xss

SUSPICIOUS: the skill is internally coherent and has no installer or credential-harvesting behavior, but it is an offensive security skill that enables an AI agent to scan arbitrary targets, plant blind-XSS beacons, and pursue session/token theft outcomes. Risk comes from exploit capability and external OOB data flow, not from malware-like concealment or supply-chain abuse.