Skills
Navigate
skills/reason-machines/security-skills/acidrain-xss-security-testing/Gen Agent Trust Hub

acidrain-xss-security-testing

Fail

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from an untrusted GitHub user account (github.com/henry-lewiskpp1107/acidrain-security-script-hub.git) rather than an official or trusted organization.
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to download the external repository and immediately execute its contents, such as starting a PHP development server to run the included scripts.
  • [DATA_EXFILTRATION]: The scripts/javascript/cookie-extractor.js file contains a function exfiltrateToTestServer that extracts all browser cookies and sends them to a remote URL (defaulting to http://localhost:8080/collect but configurable via environment variables) using the fetch API.
  • [COMMAND_EXECUTION]: The skill uses shell commands like git clone and php -S to facilitate the acquisition and execution of code from the external, untrusted source.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 18, 2026, 05:06 PM