webtoon-harness

SUSPICIOUS: the skill's purpose is coherent, but it expands trust by installing/scaffolding upstream skills and repos, giving it a larger-than-usual supply-chain footprint. The main risk is transitive trust and shell-based GitHub installation, not confirmed malware or hidden exfiltration.

No direct malware behavior is evident in the script logic itself (it only clones, copies, and optionally runs npx to install a skill). The main security concern is supply-chain trust: it fetches remote repository contents based on environment-controlled URL/ref and copies them into the consuming project’s `.claude/` directory without pinning or integrity verification; it also optionally performs an unpinned global npx install from an external repo with reduced output visibility. This warrants scrutiny of upstream sources and installation-time environment integrity.