claude-skills-library-expert

SUSPICIOUS. The skill’s stated purpose matches its behavior, and the referenced repo appears legitimate, so this is not confirmed malware. The main risk is transitive trust: it instructs the agent/user to install many downstream skills plus one raw-GitHub curl-to-bash path, giving moderate supply-chain and prompt-injection exposure disproportionate to a simple 'expert guide' role.