skill-manager

SUSPICIOUS: the footprint mostly matches a skill manager, but it materially extends the agent’s trust boundary by cloning and installing arbitrary third-party GitHub skill content into active agent directories. No direct exfiltration or overtly malicious behavior is shown, yet the broad repo provenance, writable config scope, and non-blocking security checks make it a meaningful supply-chain risk.

代码的预期用途是交互式删除 skill 或 command。未发现明确恶意载荷、数据泄露或持久化行为，但 `ITEM_NAME` 未做路径遍历防护，可能导致删除预期目录之外的文件或目录；同时 source 外部 `target.sh` 的行为需要单独审查。应限制名称为安全的单级标识符，并在删除前对规范化路径执行目录边界校验。