acidrain-xss-security-testing

SUSPICIOUS. The skill’s offensive web-testing purpose broadly matches its capabilities, but the install source is an unverifiable personal GitHub repo that does not match the claimed ara.so publisher, triggering a high supply-chain concern. The included cookie extraction and POST helper adds real exfiltration potential. This looks more like a risky, weak-provenance security tool than confirmed malware.