aigo-client-collab

SUSPICIOUS. The workflow and GitHub usage are broadly consistent with a client-collaboration skill, and the GitHub CLI appears to be an official first-party dependency. Risk comes from the mandatory execution of an unseen local self-update script on every trigger and reliance on another unverified skill, which leaves install trust and data flow only partially verifiable.

This updater checks and synchronizes a skill from `github[.]com` and `raw[.]githubusercontent[.]com`, using destructive git operations or ZIP mirroring. The principal security concern is ZIP path traversal, which can write files outside the installation directory if the downloaded archive is malicious or compromised; mirroring can also delete local files, and state-file paths can redirect updates. No credential collection, unrelated network destination, or explicit malware behavior is present in this fragment. Severity: medium, with risk dependent on archive integrity and local state-file integrity.