xss-html-injection

SUSPICIOUS: the skill is internally coherent as an XSS testing guide, but its actual footprint is an offensive AI-agent capability that includes credential theft, phishing, session hijacking, and exfiltration demonstrations. There is no malicious installer or hidden execution, yet the exploit-oriented instructions create high misuse risk disproportionate to a normal developer-assistance skill.