web-vuln-saml-sso

SUSPICIOUS: the skill is internally coherent as a SAML security-testing guide and does not show obvious credential theft or third-party interception, but it gives an AI agent explicit offensive exploit capability against live SSO systems. Install trust is relatively low risk, while the main concern is high-risk exploit tooling and real-world authentication abuse potential.

The code is explicitly an exploitation/testing set for SAML SSO security flaws: it strips/relocates signatures (bypass attempts), manipulates NameID (impersonation/comment-based parsing confusion), and injects XXE payloads targeting local file disclosure. It actively sends crafted SAMLResponses to a provided ACS URL via curl and checks for success signals (HTTP headers/cookies or response body indicators). There is no obfuscation, but the intent and implemented actions align strongly with unauthorized authentication bypass and XXE exploitation. This should not be used as a dependency in production build/install contexts without strict isolation and user-controlled execution.