hunt-xss

SUSPICIOUS. The skill is internally consistent as an XSS hunting/exploitation guide and has no notable supply-chain or credential-forwarding issues, but its stated purpose is itself an offensive security capability for AI agents. It teaches exploitation, token theft, and OOB exfiltration on arbitrary targets, creating high operational risk even without hidden behavior or malicious installers.