xss-methodology

该技能与其宣称目的基本一致，但其目的本身是为 AI 代理提供完整的 XSS 检测、利用、绕过和外泄方法，属于攻击性安全/利用工具。未见安装器、第三方二进制、凭据请求或隐藏数据流，因此不像凭据窃取型恶意技能；但其可直接支持漏洞利用和数据外泄，整体应判为高风险、偏可疑而非确认恶意。

This fragment is not a runnable package implementation; it is offensive, exploitation-oriented evaluation/instruction data for XSS and CSP/WAF bypass. It contains explicit mappings to common XSS sources (e.g., attacker-controlled template/URL fragment/attribute inputs) and sinks/effects (e.g., innerHTML/handler execution) and requests concrete payloads. While there is no evidence of backdoor malware behavior in this fragment, its content is highly misuse-prone and should be treated as security-sensitive in a supply-chain context.