The Agent Skills Directory

[OBFUSCATION]: The skill documentation includes an XSS payload example that uses a common obfuscation technique to execute code.
Evidence: The file SKILL.md contains the payload <img src=x onerror="eval(atob('YWxlcnQoJ1hTUycp'))">, where atob decodes a Base64 string into an executable command.
[DATA_EXFILTRATION]: The skill provides a script designed to capture and transmit sensitive browser data to a remote endpoint for testing purposes.
Evidence: The script scripts/javascript/cookie-exfil-test.js demonstrates how to access document.cookie and send it to a remote URL using the fetch API.
[EXTERNAL_DOWNLOADS]: The installation instructions direct the user to download the primary skill content from an external GitHub repository that is not managed by the skill's author or a trusted vendor.
Evidence: git clone https://github.com/henry-lewiskpp1107/acidrain-security-script-hub.git in the Installation section of SKILL.md.

acidrain-security-testing-scripts