literature-review-tools

SUSPICIOUS: the skill’s behavior matches its stated purpose, but that purpose is unusually broad and depends on installing and executing many external tools, MCP servers, and cloned UIs with shared API keys. Data flows mostly go to expected scholarly/vendor endpoints, so this is not confirmed malware, but the transitive supply-chain and credential-forwarding surface makes it high risk for an AI skill.

No explicit malware is present in this file (no obfuscated payloads, no credential theft routines, no network exfiltration targets hardcoded). However, the code is a powerful execution/supply-chain harness: it reads tool/workflow definitions from JSON, installs dependencies from recipe-provided pip lists, clones external repos for UIs, and executes recipe-defined scripts/entries (and may even execute recipe-provided 'python -c' example code). It also writes API keys to plaintext .env files. Overall, the primary risk is supply-chain tampering (malicious recipes or compromised upstream dependencies/repos) leading to arbitrary code execution with access to sensitive environment variables.