byted-skillhub-download

This is an authenticated SkillHub client that lists, downloads, saves, and extracts skill ZIP archives. There is no clear evidence of intentional malware, credential theft, persistence, or unauthorized exfiltration. The main security issue is unsafe archive extraction: ZIP members are not validated before extractall, creating a potential path traversal/file overwrite vulnerability when downloading untrusted or compromised archives. Use HTTPS-enforced API endpoints, avoid logging sensitive response headers, and validate each archive member path before extraction.