skill-installer

SUSPICIOUS. The stated purpose matches the behavior, and data flows stay within official GitHub channels, so this is not overtly malicious. However, the skill's core capability is transitive installation of arbitrary third-party skills, including private repos with existing credentials, which materially raises supply-chain and trust-chain risk beyond a normal installer.

This module appears to be a functional GitHub-based installer that fetches and installs arbitrary repository content chosen by user input. It does not show overt malware behavior (no exfiltration, credential theft, or hidden execution) within the provided code. The security risk is mainly supply-chain and operational: it executes git based on user-controlled ref/paths, downloads and extracts third-party ZIP archives, and then copies untrusted directories into the local filesystem after only minimal validation (SKILL.md presence). ZIP extraction includes a basic boundary check against path traversal, but additional archive safety (symlink/hardlink/resource exhaustion) and stronger integrity verification (commit pinning/signatures/hashes) are not evident in this module.