A security consultant has notified Skype of a cross-site scripting flaw that could be used to change the password on someone’s account.