xss-html-injection

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill document is explicitly offensive: it provides actionable XSS payloads, cookie/keylogger/session exfiltration code, and phishing/form-capture examples targeting attacker-controlled endpoints, facilitating credential theft and data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow describes submitting and monitoring for XSS by sending attacker-supplied payloads into user input fields of a user-specified target web application (e.g., search/comments) and then observing execution/reflection in responses, which directly ingests outsider-authored free text at runtime.