cafe3310-skill-installer

SUSPICIOUS. The skill’s behavior matches its stated purpose, but that purpose is itself high-trust: it clones a personal GitHub repo, executes an unpinned shell script, and installs additional skills transitively. No direct credential theft or off-platform exfiltration is evident, so this is not malware, but it carries meaningful supply-chain and trust-chain risk.

The installer itself shows no clear malware such as credential theft, exfiltration, persistence, or command execution. It presents a material supply-chain risk because it downloads and installs unpinned remote agent skills without verification or review, and it can recursively replace existing directories based on a weak text marker. The downloaded skill contents require separate inspection before use.

该片段是一个远程 Agent 技能安装器的宣传和使用说明，而非实际恶意代码。它引导 Agent 无需人工审查地执行来自 GitHub 的远程指令，并修改本地技能目录，因此存在明显的供应链和提示注入风险。应在隔离环境中审查 SKILL.md、安装脚本及具体提交，验证签名或哈希，并避免授予未经审查的远程内容 Bash 权限。