hunt-xss

SUSPICIOUS. The skill is internally consistent as an XSS hunting guide, but its actual footprint is an offensive security capability set for an AI agent: active probing, exploit payloads, bypass techniques, and credential/token theft chains. No clear malicious installer, secret-harvesting endpoint, or covert exfiltration is present, so this is not confirmed malware; however, it is a high-risk exploit skill that should be tightly controlled and not treated as benign developer documentation.