xss-html-injection

SUSPICIOUS. The skill is purpose-aligned as an offensive web security testing guide, but its core function is to equip an AI agent with exploitation techniques for XSS, session hijacking demos, phishing-form injection, and credential capture scenarios. There is no evidence of hidden malware, remote installers, credential forwarding to third-party binaries, or live exfiltration endpoints beyond reserved placeholder domains, so this is not confirmed malicious. Risk is elevated because it operationalizes offensive security actions for an AI agent even with authorization guardrails.