acidrain-security-script-hub

SUSPICIOUS. The skill is internally coherent as a web security/XSS testing guide, and the flagged command-injection items are documentation false positives. However, it equips an AI agent with offensive security testing procedures and is distributed from a weakly verified personal GitHub source that does not clearly match the stated publisher, so overall risk is high even without confirmed malware or exfiltration.