unzip

SUSPICIOUS: the core unzip behavior is legitimate, but the skill is broader than advertised because it can fetch and execute npm code at runtime, install extracted dependencies, alter build-allow settings, and restart services. This is not confirmed malicious, but it carries medium risk due to supply-chain exposure and untrusted archive content leading to code execution paths.