vibenet

SUSPICIOUS: the skill’s purpose and Base data flows are mostly coherent, but it expands trust by requiring a setup script, a GitHub fork build, and a transitive skill installer. This looks like a legitimate developer guide with medium supply-chain risk rather than confirmed malware.

No explicit malicious logic (e.g., backdoor/persistence/exfiltration) is present in this Bash fragment itself. However, the script performs a high-trust supply-chain operation: it can be redirected via VIEM_FORK_REPO/VIEM_FORK_BRANCH to clone arbitrary remote code, then executes pnpm install/build from that fetched code, and finally installs the resulting artifacts into the application. The primary risk is compromise or tampering of the fetched fork/branch or its dependency tree, not overt malware embedded in the script.