discover-skills

SUSPICIOUS: 查询功能本身较合理，但该技能的真实核心能力是从第三方 CDN 获取并安装其他技能到持久化代理目录，且缺少完整性验证。这种传递安装链与远程 ZIP 安装模式带来高供应链风险，即使当前脚本未明显窃取凭证。

No explicit malware (credential theft, backdoor logic, or encoded payload) is visible in the provided documentation excerpt. However, it documents a high-impact supply-chain installation workflow: it enables downloading and installing remote skill.zip archives from a CDN into hidden, persistent per-user directories, without describing checksum/signature verification or allowlist-based trust controls. This combination warrants a high security review focus on integrity verification and installation/sandboxing for any ZIP contents.