skill-finder

SUSPICIOUS: the core behavior is coherent for a skill-finder, and the documented dependencies come from official sources, so this is not malware. The main risk is transitive trust: it helps install arbitrary third-party skills from GitHub/gists and expand sources, which is proportionate to its purpose but still materially risky and should require explicit per-install review.

No clear malicious payload, data theft, persistence, cryptomining, reverse shell, or intentional sabotage is present. The code does introduce supply-chain risk by installing files from user-selected GitHub repositories without pinning or integrity checks, and it has a potential path traversal/arbitrary-file-write issue because remote file names are joined directly to the installation path. The provided fragment also appears syntactically incomplete.