xss-reflected

SUSPICIOUS. The skill is coherent as an XSS exploitation guide, but it equips an AI agent with offensive security techniques including cookie theft, credential capture, and malware-delivery scenarios. There is no direct installer or credential-harvesting path in the skill itself, so this is not confirmed malware, but it is high-risk due to its exploit-focused purpose and some weak-provenance tool references.