literature-review-tools

SUSPICIOUS: the skill's behavior is broadly aligned with its literature-review purpose, but it acts as a high-trust launcher for many third-party tools, clones repos, and forwards API keys into external code. This looks more like a risky orchestration skill than overt malware; main concerns are supply-chain trust, credential forwarding, and transitive trust into MCP/skill ecosystems.

No direct evidence of built-in malware/obfuscation in this snippet, but it is a high-privilege orchestrator that (1) reads untrusted recipe/workflow JSON to determine what to install and execute, (2) installs arbitrary dependencies via pip/uv, (3) clones and installs from external repos for web UIs, (4) executes recipe-defined entry points/scripts, and (5) can execute arbitrary Python code from a recipe's 'example' field when it starts with 'python -c'. It also writes and passes API keys to child processes and may persist them to .env files. Overall, the dominant risk is supply-chain/recipe tampering leading to arbitrary code execution and credential exposure.