prd-taskmaster-v2

Mostly coherent task-planning skill with legitimate upstream TaskMaster integration, but it is broader than a normal PRD helper: it supports pentest goals, has Bash/WebSearch/Skill access, and can act autonomously or hand off to other workflows. Overall this looks suspiciously broad rather than malicious; supply-chain risk is low-to-moderate, while autonomy and capability scope drive the main security concern.

No explicit malware behavior is present in this installer script itself (it does not execute downloaded content during installation and shows no overt data theft/exfiltration). However, it presents a meaningful supply-chain risk: it clones an unpinned remote GitHub repository and installs repository-provided artifacts into a persistent location, including copying install.sh and marking it executable, without any integrity verification (pinning/checksums/signatures). If the upstream repository or release is compromised, this installer could propagate malicious skill code or self-update logic to end users.