payloads-smuggling

The skill is a security-testing reference, not malware: it contains no install chain, credential access, or hidden data flow. However, it equips an agent with actionable exploit techniques, including a victim-browser desync example, so its security risk is high despite the authorized-use disclaimer.